What is CVE-2025-30238?
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.
The record classifies CVE-2025-30238 under weakness class CWE-863. 12 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 56 days ago.
Severity and exploitation probability
- CVSS v4.0 base score
- 8.6 — High (derived from score)
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 4.3/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-08-10
Is CVE-2025-30238 being exploited?
It currently carries a trending score of 30 in the Threadlinqs vulnerability feed.
Affected products and versions
- TP-Link Systems Inc.: HB810(US2) V1.0/1.6/2.0/2.6, HB810(EU1) V2.0, HB710(US2) V1.6/1.0, HB710(EU1) 1.0, HB610(US2) V2.6/2.0, HB610(EU1), HB610(CA) V2.0, HB410( EU1) 1.0, HB210(US2) 1.0, HB210(EU1) 1.0, HB210 Pro(EU1)1.0, HB210 Pro(US2)1.0/1.6
How to fix CVE-2025-30238
No vendor patch reference has been recorded for CVE-2025-30238 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2025-30238
No threat campaign in the Threadlinqs corpus currently references CVE-2025-30238, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.
Sources
Enriched from CVE.org, NVD. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.