CVE-2025-30240CWE-59

CVE-2025-30240

published August 11, 2026

CVSS
5.1
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage

devices. By placing a crafted symbolic link on supported storage media, an

attacker may cause the system to resolve the link.

Successful

exploitation may allow unauthorized read access to sensitive files within the

device filesystem.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.3th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-08-11T03:16Z
References (1)
https://www.tp-link.com/us/support/faq/5239/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 10 AUG 22:25Z
    Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices
    cvelistv5