# CVE-2025-30238 — TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6

> As of 2026-08-10, CVE-2025-30238 is a High-severity (band derived from the CVSS v4.0 score, not stated by the CNA) vulnerability in TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6, CVSS v4.0 8.6. No Threadlinqs-tracked threat campaign has been attributed to CVE-2025-30238 as of 2026-08-10; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest.

**Last updated:** 2026-08-10

## What is CVE-2025-30238?

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

The record classifies CVE-2025-30238 under weakness class [CWE-863](https://intel.threadlinqs.com/cwe/CWE-863). 12 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 56 days ago.

## Severity and exploitation probability

- **CVSS v4.0 base score:** 8.6 — High (derived from score) (`CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 4.3/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-08-10

## Is CVE-2025-30238 being exploited?

It currently carries a trending score of 30 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [TP-Link Systems Inc.](https://intel.threadlinqs.com/vendors/tp-link-systems): HB810(US2) V1.0/1.6/2.0/2.6, HB810(EU1) V2.0, HB710(US2) V1.6/1.0, HB710(EU1) 1.0, HB610(US2) V2.6/2.0, HB610(EU1), HB610(CA) V2.0, HB410( EU1) 1.0, HB210(US2) 1.0, HB210(EU1) 1.0, HB210 Pro(EU1)1.0, HB210 Pro(US2)1.0/1.6

## How to fix CVE-2025-30238

No vendor patch reference has been recorded for CVE-2025-30238 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2025-30238

No threat campaign in the Threadlinqs corpus currently references CVE-2025-30238, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.

## Sources

Enriched from CVE.org, NVD. Last verified by Threadlinqs on 2026-08-12. This product uses the NVD API but is not endorsed or certified by the NVD.

**Vendor advisory and patch**

- [tp-link.com — vendor advisory](https://www.tp-link.com/us/support/faq/5239/)

Canonical: https://intel.threadlinqs.com/cve/CVE-2025-30238
Full detection coverage and IOCs for threats exploiting CVE-2025-30238 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp