CVE-2025-30239: Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

Severity: high (CVSS 8.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-09
Weakness: CWE-321

Description

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

Affected products

TP-Link Systems Inc. EB210 Pro(EU1) 1.0: before 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n — fixed in 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
TP-Link Systems Inc. EB210 Pro(US1) 1.0: before 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n — fixed in 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
TP-Link Systems Inc. EB810v(EU1) V1.0: before 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n — fixed in 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n
TP-Link Systems Inc. EC220-G5(BR) V3.0: before 1.14.1 Build 250715 Rel.72650n(4252) — fixed in 1.14.1 Build 250715 Rel.72650n(4252)
TP-Link Systems Inc. EC220-G5(EU1) V3.0: before 1.15.1 Build 260205 Rel.38208n(4555) — fixed in 1.15.1 Build 260205 Rel.38208n(4555)
TP-Link Systems Inc. EC220-G5(US1) V3.0: before 1.14.1 Build 250715 Rel.72650n(4252) — fixed in 1.14.1 Build 250715 Rel.72650n(4252)
TP-Link Systems Inc. EC225-G5(BR) V1.0: before 1.14.1 Build 250717 Rel.34953n(4252) — fixed in 1.14.1 Build 250717 Rel.34953n(4252)
TP-Link Systems Inc. EC225-G5(EU1) V1.0: before 1.14.1 Build 250711 Rel.35878n(4555) — fixed in 1.14.1 Build 250711 Rel.35878n(4555)
TP-Link Systems Inc. EC225-G5(US1) V1.0: before 1.1.14.1 Build 250711 Rel.35607n(5553) — fixed in 1.1.14.1 Build 250711 Rel.35607n(5553)
TP-Link Systems Inc. EX141(BR) V1.0/1.9: before 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n — fixed in 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n
TP-Link Systems Inc. EX141(EU1) V1.0: before 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n — fixed in 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
TP-Link Systems Inc. EX141(US1) V1.0: before 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n — fixed in 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
TP-Link Systems Inc. EX220(BR) V1.0/1.20/1.28/1.29/1.8: before 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n — fixed in 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
TP-Link Systems Inc. EX220(BR) V2.0: before 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n — fixed in 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n
TP-Link Systems Inc. EX220(EU1) V1.0/1.20: before 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n — fixed in 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
TP-Link Systems Inc. EX220(RU) V1.0: before 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n — fixed in 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
TP-Link Systems Inc. EX220(US1) V1.0: before 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n — fixed in 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
TP-Link Systems Inc. EX222(EU1) V1.0: before 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n — fixed in 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
TP-Link Systems Inc. EX222(KR) V1.0: before 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915 — fixed in 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915
TP-Link Systems Inc. EX222(US1) V1.0: before 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n — fixed in 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
TP-Link Systems Inc. EX511(BR) V2.0/2.8/2.9: before 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n — fixed in 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
TP-Link Systems Inc. EX511(EU1) V2.0: before 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n — fixed in 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
TP-Link Systems Inc. EX511(US1) V2.0: before 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n — fixed in 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n
TP-Link Systems Inc. EX520(US1) V1.0: before 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n — fixed in 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n
TP-Link Systems Inc. EX520v(EU1)1.0: before 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n — fixed in 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n
TP-Link Systems Inc. EX521(US1) V1.0: before 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n — fixed in 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n
TP-Link Systems Inc. EX820v(EU1) V1.0: before 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n — fixed in 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n
TP-Link Systems Inc. EX920(US2) V1.6/V1.0: before 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n — fixed in 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n
TP-Link Systems Inc. HB210 Pro(EU1)1.0: before 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n — fixed in 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n
TP-Link Systems Inc. HB210 Pro(US2)1.0/1.6: before 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n — fixed in 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. EB210 Pro(EU1) 1.0 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n; TP-Link Systems Inc. EB210 Pro(US1) 1.0 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n; TP-Link Systems Inc. EB810v(EU1) V1.0 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n; TP-Link Systems Inc. EC220-G5(BR) V3.0 1.14.1 Build 250715 Rel.72650n(4252); TP-Link Systems Inc. EC220-G5(EU1) V3.0 1.15.1 Build 260205 Rel.38208n(4555); TP-Link Systems Inc. EC220-G5(US1) V3.0 1.14.1 Build 250715 Rel.72650n(4252); TP-Link Systems Inc. EC225-G5(BR) V1.0 1.14.1 Build 250717 Rel.34953n(4252); TP-Link Systems Inc. EC225-G5(EU1) V1.0 1.14.1 Build 250711 Rel.35878n(4555); TP-Link Systems Inc. EC225-G5(US1) V1.0 1.1.14.1 Build 250711 Rel.35607n(5553); TP-Link Systems Inc. EX141(BR) V1.0/1.9 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n; TP-Link Systems Inc. EX141(EU1) V1.0 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n; TP-Link Systems Inc. EX141(US1) V1.0 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n. Check the vendor advisory for mitigations.

References

https://www.tp-link.com/us/support/faq/5239/

Get alerted when CVE-2025-30239 or the next vulnerability affects your stack