TL;DR: TP-Link Aginen router firmware has a command injection vulnerability in its web management interface. An authenticated attacker on the same network can inject OS commands through unsanitized input that reaches system-level execution functions. Successful exploitation gives full device takeover with elevated privileges. Firmware updates are available for all affected models.

What to Do First

Update your router firmware. This is the single most effective action. TP-Link has released fixed firmware for every affected model. Log in to your router's web management interface, check the current firmware version, and compare it against the fixed version for your specific hardware model below. If your firmware is older, download the update from TP-Link's support page and apply it.

If you cannot update immediately, restrict physical network access. The attacker must be on the same local network (adjacent access requirement), so your exposure depends on who can reach your LAN. Disable remote management if it is enabled. Change the admin password to something unique if it is still the factory default.

What Happened

The web management interface on affected TP-Link Aginen devices passes user-supplied input to system-level command execution functions without proper validation or sanitization. An authenticated attacker on the adjacent network can craft input that embeds operating system commands. When the firmware's backend processes that input, it executes the injected commands with elevated privileges.

The vulnerability affects the web interface specifically, which means any device on the local network that can reach the router's management IP can attempt exploitation. The attacker needs valid credentials to reach the vulnerable interface component, but once authenticated, the command injection path is straightforward.

Successful exploitation means full device compromise. The router sits at the network perimeter and handles all traffic routing. An attacker who gains command execution on the router can intercept DNS queries, redirect traffic, monitor all network communications, establish persistent backdoors, and pivot to other devices on the network.

What TP-Link Aginen Is

TP-Link Aginen is TP-Link's lineup of mesh Wi-Fi systems and access points designed for home and small business networks. The product family includes extenders (EX series), mesh hubs (HB series), range expanders (HX series), and main routers (VX, XC, XX series). These devices are sold in multiple regional variants denoted by country codes like EU1, US1, BR, RU, and KR.

TP-Link is one of the largest consumer networking equipment manufacturers globally, with tens of millions of devices deployed in homes and small offices. The Aginen line targets the mesh networking segment, where multiple units work together to blanket a space in Wi-Fi. The wide device list in this advisory reflects how TP-Link shares firmware code across product lines, which is why a single web interface vulnerability affects 30+ distinct hardware models.

Who Is Affected

The advisory lists 30 affected device models across the Aginen family. Below are the key models and their fixed firmware versions:

• EB210 Pro (EU1/US1): fixed in 0.2.0 3.0.0 v60f4.0 Build 250807
• EB810v (EU1): fixed in 0.6.0 3.0.0 v608b.0 Build 250613
• EX220 (all regional variants): fixed in 0.20.0 2.0.0 v605f.0 Build 250305 (older units) or 0.19.0 2.0.0 v609b.0 Build 250814 (V2.0 units)
• EX222 (all regional variants): fixed in 0.20.0 2.0.0 v605f.0 or 0.20.0 2.0.0 v609b.0 Build 260427 (KR)
• HB210 Pro (EU1/US2): fixed in 0.5.0 or 0.8.0 builds
• HB610 (EU1/US2/CA): fixed in 0.6.0 3.0.0 v60af.0 Build 251204/251216
• HB810 (EU1/US2): fixed in 0.10.0 or 0.9.0 3.2.2 builds
• VX420-G2h (AU): fixed in 800.0.16
• VX800v (DE): fixed in 0.16.0 3.0.0 v6066.0

The complete list includes additional models. Check the advisory on hol.org for firmware versions specific to your hardware revision.

Why It Matters

Router command injection vulnerabilities are high-value targets. The router is the chokepoint for every device on the network. Compromise it and you control DNS resolution, traffic routing, and network segmentation for everything behind it.

The adjacent access requirement limits remote exploitation, but it does not eliminate risk. Anyone on the same Wi-Fi network, including guests, IoT devices, and compromised endpoints, satisfies the adjacency requirement. In a small business or shared office, this means any employee or any compromised device on the LAN.

Not in CISA KEV. Not known to be exploited in the wild at time of disclosure. NVD enrichment is pending.

References

• hol.org CVE entry: https://hol.org/guard/security/cves/CVE-2025-30241-os-command-injection-in-web-interface-in-multiple
• TP-Link security advisories: https://www.tp-link.com/en/support/download/