CVE-2025-30241

HighCVSS 8.6/10Last modified Sep 29, 2026

Description

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.

Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 10, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-302479.3An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remot CVE-2025-302488.9DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary CVE-2025-30257.3Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM pri CVE-2025-302545.3An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.CVE-2025-302558.2Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allo CVE-2025-302567.5A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted serie CVE-2025-302575.3Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.CVE-2025-302584.7In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has inc CVE-2025-302593.5The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and con CVE-2025-30266.1The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an H CVE-2025-302606.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-302616.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains