Critical TP-Link Omada Flaws Allow Authentication Bypass, Privilege Escalation

Key Takeaways

• TP-Link has acknowledged multiple critical vulnerabilities in its Aginet networking product line, impacting various devices including routers and mesh systems.
• The flaws, ranging from authentication bypass to OS command injection, could enable attackers to gain full control over affected devices, steal sensitive data, or escalate privileges.
• These vulnerabilities, identified as CVE-2025-30237 through CVE-2025-30241, carry CVSS scores as high as 8.7.
• Remediation for these ISP-managed devices will be distributed by internet service providers, often through automatic firmware updates.

TP-Link has issued a disclosure regarding several high-severity vulnerabilities present across its Aginet family of networking products. This extensive range includes mesh systems, routers, PON devices, and xDSL modems, which are frequently provisioned and updated by internet service providers (ISPs).

Exploitation of these weaknesses could grant attackers, who possess network access, the ability to circumvent authentication mechanisms, elevate their privileges, exfiltrate sensitive data, read arbitrary device files, and execute operating system commands with elevated permissions.

The security advisory, which was last revised on August 10, 2026, details five distinct vulnerabilities, collectively tracked from CVE-2025-30237 to CVE-2025-30241. Since these devices are predominantly managed by ISPs, the availability and distribution of firmware updates may vary significantly based on the operator and geographical region.

Critical Authentication Bypass and Privilege Escalation

The most severe of the disclosed vulnerabilities is CVE-2025-30237, an authentication bypass flaw residing within the web management interface. This issue, stemming from inadequate access control on specific endpoints, has been assigned a CVSS v4 score of 8.7.

An attacker located on an adjacent network could craft and transmit malicious requests to access privileged functions without needing valid credentials. Successful exploitation of this vulnerability could grant an unauthenticated attacker complete administrative control over the compromised device.

Another high-severity vulnerability, CVE-2025-30238, carries a CVSS score of 8.6 and relates to improper authorization within user-management functions. This flaw could enable an authenticated user with low privileges to execute actions typically reserved for administrators, such as creating new privileged accounts or modifying critical device configurations. Such an exploit would allow an attacker with limited initial access to significantly broaden their control over a router or mesh node.

Sensitive Data Exposure and Command Injection Risks

CVE-2025-30239 identifies a sensitive data exposure vulnerability, rated 8.5 on the CVSS scale, involving hardcoded cryptographic keys embedded within the device firmware. An attacker who gains access to the device’s storage could potentially recover these keys. This recovery could then be used to decrypt protected configuration data, including user credentials and ISP-specific service settings, thereby exposing the device to further compromise.

A medium-severity vulnerability, CVE-2025-30240, allows for arbitrary file reading and has a CVSS score of 5.1. This flaw affects the USB HTTPS access path and is caused by improper handling of symbolic links on external USB storage. An individual with physical access to the device could create a malicious symbolic link on a compatible storage medium. This link could then be leveraged to access sensitive files located within the router’s internal filesystem.

The final vulnerability, CVE-2025-30241, is a high-severity OS command injection flaw with a CVSS score of 8.6. This issue arises because certain web-interface components fail to adequately validate user-supplied input before passing it to system-level command execution functions. An authenticated attacker on the local network could inject arbitrary commands, executing them with elevated privileges and potentially achieving full control over the device.

Affected hardware encompasses models from TP-Link’s HB, HX, HC, EB, EC, EX, XC, XX, and VX series. Specific examples include the HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v, and VX1800v variants. The precise impact of these vulnerabilities can vary depending on the regional model, hardware version, ISP customizations, and the installed firmware.

TP-Link said remediation efforts for ISP-managed devices will be coordinated directly through the respective service providers. In many instances, firmware updates may be deployed automatically via ISP management platforms, simplifying the patching process for end-users.

What You Should Do

• Check your router’s administration interface or your ISP’s management application for available firmware updates immediately.
• If an update is not yet available, contact your internet service provider to confirm if your device is affected and to inquire about the timeline for a patched firmware release.
• Restrict exposure of management interfaces by disabling remote management features unless absolutely necessary.
• Utilize strong, unique credentials for all administrator accounts on your networking devices.
• Ensure that only trusted users have access to your local network, as several of these flaws require local or adjacent-network access.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.