High severityNVD Advisory· Published Aug 10, 2026· Updated Sep 29, 2026
CVE-2025-30241
CVE-2025-30241
Description
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.
Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
5- TP-Link Sued by Four More U.S. States Over Router Security and China TiesThe Hacker News · Oct 9, 2026
- TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router FlawsSecurityWeek · Oct 8, 2026
- ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and MoreThe Hacker News · Aug 31, 2026
- Cyber Security Weekly Newsletter – Outlook RCE, Palo Alto, Cisco 0-day and Windows 0-Day Flaws +20 StoriesCyber Security News · Aug 16, 2026
- Multiple TP-Link Vulnerabilities Allow Attackers to Bypass Authentication and Escalate PrivilegesCyber Security News · Aug 14, 2026