TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws

What it is

Five TP-Link Aginet vulnerabilities — CVE-2025-30237 through CVE-2025-30241 — disclosed by TP-Link in August 2025 and detailed by SEC Consult (the discovering researchers) on October 2. The Aginet line covers ISP-managed mesh systems, routers, fiber (PON) devices, and DSL modems; TP-Link identified 65 affected device models, including ISP-customized variants.

How it works

• CVE-2025-30237 (most severe): an authentication bypass in the device's web server. An attacker with network access to the web interface can create a super-administrator account and enable SSH, with no credentials required.
• CVE-2025-30238: privilege escalation — a low-privileged user can perform admin-only actions.
• CVE-2025-30241: command injection in the web interface, letting an authenticated attacker run commands with root privileges.
• CVE-2025-30239: hardcoded encryption keys, tied only to device model, protect configuration/backup files. Anyone who obtains a backup file and extracts the model's key from firmware can recover stored passwords, Wi-Fi credentials, and (depending on config) the ISP's remote-management credentials.
• CVE-2025-30240: requires physical access — a specially prepared USB drive plugged into the device dumps the entire filesystem.

SEC Consult: "These vulnerabilities allowed an unauthenticated attacker on the same network to fully compromise the affected device."

Preconditions / Affected

• CVE-2025-30237 and the USB attack (CVE-2025-30240) need no credentials — just network or physical access respectively.
• CVE-2025-30238 and -30241 need an existing low-privileged/authenticated account first.
• CVE-2025-30239 requires obtaining a config/backup file plus extracting the per-model key from firmware.
• 65 Aginet-branded device models are affected, including ISP-rebranded variants; TP-Link said full identification of all affected models wasn't completed until July 2025, and firmware rollout (including ISP-custom builds) stretched into 2026.

What to do

• Firmware fixes are distributed through ISPs, not directly by TP-Link. Check the device's management interface or app for updates; if none is available, contact your ISP.
• SEC Consult withheld PoC exploit code specifically because many vulnerable devices remain unpatched — treat these as live, exploitable issues on the network, not theoretical.
• Given the unauthenticated super-admin bypass (CVE-2025-30237), restrict web-management-interface access to trusted networks until patched.

Caveats

SEC Consult began reporting these flaws to TP-Link in December 2024; TP-Link claimed initial fixes in January 2025, but full scope and ISP-distributed patching were still rolling out as of the report, with some rollout continuing into 2026 — meaning unpatched devices on ISP networks may persist well past disclosure.