CVE-2025-30240

Received Received - Intake

Symbolic Link Traversal in TP-Link Aginet Devices

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: TPLink

Description

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2025-30240

EUVD

EUVD-2025-210676

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	aginet	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects TP-Link Aginet devices by allowing improper validation of symbolic links on external USB storage. Attackers can create crafted symbolic links that the system resolves, potentially leading to unauthorized access to sensitive files within the device's filesystem.

Impact Analysis

Exploitation may allow unauthorized read access to sensitive files on the device, potentially exposing confidential data or system configurations. This could lead to data breaches or further compromise of the device.

Mitigation Strategies

Disable USB storage access on affected TP-Link Aginet devices until a patch is available. Regularly monitor device logs for unusual file access patterns. Avoid using untrusted USB storage devices with these systems.

Hi! I’m here to help you understand CVE-2025-30240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70