CVE-2025-30240: TP-Link Aginet Information Disclosure

CVE-2025-30240 Overview

CVE-2025-30240 affects TP-Link Aginet devices that fail to properly validate symbolic links on external USB storage media. An attacker with physical access to the device can plant a crafted symbolic link on attached storage. When the device resolves the link, it grants unauthorized read access to sensitive files inside the device filesystem. The flaw is classified as [CWE-59] Improper Link Resolution Before File Access (Link Following). Exploitation requires physical access to the USB port, which limits the attack surface but does not eliminate risk in shared or unattended deployments.

Critical Impact
Successful exploitation allows an attacker with physical USB access to read arbitrary files from the TP-Link Aginet device filesystem, exposing configuration data and credentials.

Affected Products

TP-Link Aginet routers with USB storage support
Aginet firmware versions that lack symlink validation on external storage
See the TP-Link Support FAQ for the authoritative list of affected models

Discovery Timeline

2026-08-10 - CVE-2025-30240 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2025-30240

Vulnerability Analysis

The vulnerability is a symbolic link (symlink) following flaw in the file access logic of the TP-Link Aginet device firmware. The device exposes USB-attached storage through internal file services. When the firmware processes files on that storage, it follows symbolic links without confirming that the link target resides inside the intended USB mount path. An attacker prepares a USB device containing symlinks that point to absolute paths on the device filesystem, such as configuration files, credential stores, or system logs. Inserting the media into the router causes the firmware to resolve those links and return the contents of arbitrary files. The impact is limited to confidentiality: the CVSS vector indicates high impact on confidentiality and no impact on integrity or availability.

Root Cause

The root cause is missing canonical path validation after link resolution. The firmware treats symlinks on removable media as trusted and does not verify that the resolved target remains within the storage device's mount boundary. This class of bug is tracked as [CWE-59]. A correct implementation would call a canonicalization routine and reject any path that escapes the USB mount root.

Attack Vector

The attack vector is physical. An attacker must connect a prepared USB storage device to the router's USB port. No authentication, user interaction, or network access is required once the media is inserted. The attacker crafts symlinks on the USB media that reference sensitive files such as /etc/passwd, configuration backups, or credential databases. When the router indexes or serves the USB contents, it dereferences the links and exposes the target file data to any interface that reads from the USB share.

No public proof-of-concept code is available. Refer to the TP-Link Support FAQ for vendor-supplied technical details.

Detection Methods for CVE-2025-30240

Indicators of Compromise

Unexpected USB storage devices connected to Aginet routers in managed environments
Router logs showing file access requests for paths outside /mnt/usb or the equivalent USB mount point
Symbolic link entries on USB media that reference absolute paths on the router filesystem
Anomalous read activity against configuration or credential files following USB insertion events

Detection Strategies

Inspect USB media offered to shared or field-deployed routers for symlinks pointing outside the media root
Monitor router system logs for USB mount events correlated with file access to sensitive paths
Baseline expected USB usage and alert on insertions in environments where USB storage is not authorized

Monitoring Recommendations

Forward router syslog data to a centralized log platform for correlation and retention
Alert on USB device connect events on production Aginet routers
Track firmware versions across the fleet to identify devices still exposed to CVE-2025-30240

How to Mitigate CVE-2025-30240

Immediate Actions Required

Disable USB storage services on Aginet routers where the feature is not required
Physically restrict access to router USB ports in shared or public locations
Apply the firmware update referenced in the TP-Link Support FAQ as soon as the vendor publishes it for your model
Audit currently connected USB media and remove any untrusted devices

Patch Information

TP-Link publishes firmware fixes and affected model lists through the vendor advisory portal. Consult the TP-Link Support FAQ for the specific firmware version that addresses CVE-2025-30240 for each affected Aginet model. Schedule firmware upgrades during a maintenance window and verify the version after reboot.

Workarounds

Disable the USB file sharing or media server feature in the router administration interface
Enforce a policy that prohibits attaching unapproved USB storage to network infrastructure
Use tamper-evident seals or lockable enclosures for routers deployed in publicly accessible areas
Segment router management interfaces so that any exposed file data cannot be retrieved remotely without further authentication