CVE-2025-30240

Awaiting Analysis Awaiting Analysis - Queue

Symbolic Link Traversal in TP-Link Aginet Devices

Publication date: 2026-08-10

Last updated on: 2026-08-18

Assigner: TPLink

Description

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-18

Generated

2026-08-31

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-29

NVD

CVE-2025-30240

EUVD

EUVD-2025-210676

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	aginet	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects TP-Link Aginet devices by allowing improper validation of symbolic links on external USB storage. Attackers can create crafted symbolic links that the system resolves, potentially leading to unauthorized access to sensitive files within the device's filesystem.

Detection Guidance

This vulnerability involves improper validation of symbolic links on external USB storage devices in TP-Link Aginet devices. Detection requires checking for unauthorized file access or unusual symbolic link creation on connected USB storage. No specific commands are provided in the context to detect this issue.

Impact Analysis

Exploitation may allow unauthorized read access to sensitive files on the device, potentially exposing confidential data or system configurations. This could lead to data breaches or further compromise of the device.

Compliance Impact

The vulnerability allows unauthorized read access to sensitive files on the device filesystem, which could lead to exposure of personal or health data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) if such data is compromised.

Mitigation Strategies

Disable USB storage access on affected TP-Link Aginet devices until a patch is available. Regularly monitor device logs for unusual file access patterns. Avoid using untrusted USB storage devices with these systems.

Hi! I’m here to help you understand CVE-2025-30240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70