CVEvulnerability

CVE-2025-30241

8.6 HIGH Published 2026-08-10 Modified 2026-09-29 Official page ↗
Status
Awaiting Analysis
Published
2026-08-10
Last modified
2026-09-29
Assigner
f23511db-6c3e-4e32-a477-6aa17d310630
CVSS 4.0 (f23511db-6c3e-4e32-a477-6aa17d310630)
8.6 HIGH — CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-78

Description

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions.  An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References