CVE-2025-30237: Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations.
Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30237?
The severity of CVE-2025-30237 is rated as 82, indicating a high risk.
How do I fix CVE-2025-30237?
To fix CVE-2025-30237, update the TP-Link Aginet devices to the latest firmware version that addresses the authentication bypass vulnerability.
What devices are affected by CVE-2025-30237?
CVE-2025-30237 affects various TP-Link Aginet devices that have the flawed web management interface.
What type of vulnerability is CVE-2025-30237?
CVE-2025-30237 is classified as an authentication bypass vulnerability caused by broken access control in the web server.
What can an attacker do with CVE-2025-30237?
An attacker exploiting CVE-2025-30237 can bypass authentication and gain access to privileged functionalities without valid credentials.