CVE-2025-30237: tp-link systems inc. ex141(br) v1.0/1.9 Missing Authorization

Vulnerability summary

CVE-2025-30237 is a high (CVSS 8.7) Missing Authorization vulnerability in tp-link systems inc. ex141(br) v1.0/1.9. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.9% of scored vulnerabilities.

Timeline

1. 10-08-2026
   PublishedVulnerability first disclosed.
2. 09-10-2026
   Last modifiedVulnerability information updated.

Description

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.