Search
Find a vulnerability
Search criteria
1 vulnerability found for Multiple TP-Link device series by unknown
GCVE-1988-2026-0481
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
EPSS
VEX
Title
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series
Summary
SEC Consult Vulnerability Lab Security Advisory < 20261008-0 >
=======================================================================
title: Multiple critical vulnerabilities
product: Multiple TP-Link device series
Mesh: HB Series, HX Series, HC Series; Router: EB Series
EC Series, EX Series; PON: XC Series, XX Series;
xDSL modem: VX Series
vulnerable version: Multiple affected versions
fixed version: See solution below
CVE number: CVE-2025-30237, CVE-2025-30238, CVE-2025-30239
CVE-2025-30240, CVE-2025-30241
impact: critical
homepage:https://www.tp-link.com
found: 2024-12-02
by: Gerhard Hechenberger (Office Vienna)
Stefan Schweighofer (Office Vienna)
Constantin Schieber-Knoebl (Office Vienna)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"Headquartered in the United States, TP-Link is a global provider of reliable
networking devices and smart home products, consistently ranked as the
world’s top provider of Wi-Fi devices. The company is committed to delivering
innovative products that enhance people’s lives through faster, more reliable
connectivity. With a commitment to excellence, TP-Link serves customers in
over 170 countries and continues to grow its global footprint."
Source:https://www.tp-link.com/us/about/about-us/
Business recommendation:
------------------------
The vendor provides patches for multiple affected devices which should be
installed immediately.
SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.
Vulnerability overview/description:
-----------------------------------
1) Authentication Bypass (CVE-2025-30237)
The currently implemented authentication flow of the web server of the
affected device makes it possible to craft special requests, which allow
an attacker to directly execute certain actions on the device, without any
valid user credentials. This vulnerability makes it possible to execute
any action that is shown in the "Broken Access Control" vulnerability
description without any authentication. Exploiting this, an attacker
can effectively take over the device, given that access to the web server
is possible.
2) Broken Access Control (CVE-2025-30238)
The affected device features several user profiles with different
user levels. Due to insufficient checks on the device itself, an
authenticated attacker can execute actions as low privileged user that
are meant to be only executed as a high privileged user.
An authenticated attacker can therefore create a high privileged user
profile and fully take over the device by enabling SSH and logging in
with the new account.
3) Sensitive Data Stored Insecurely (CVE-2025-30239)
The affected device stores sensitive data in an ineffectively
protected format in multiple locations. The used symmetric cryptography
makes use of hardcoded keys which are only tied to the device model.
After reversing the firmware and extracting the hardcoded keys,
an attacker can effectively decrypt the following files and read
plaintext credentials, including the used passwords. Depending on the
device configuration, CWMP provider credentials can also be extracted.
- Default Configuration (default user and Wi-Fi credentials)
- Active Configuration (all user account credentials, Wi-Fi credentials and
CWMP credentials)
- Configuration Backup (all user account credentials, Wi-Fi credentials and
CWMP credentials)
4) Unsafe Symbolic Link Processing (CVE-2025-30240)
The USB port on the affected device enables an attacker to
place a symbolic link on USB storage devices and gain read access
to the complete file system of the device.
5) Authenticated OS Command Injection (CVE-2025-30241)
Multiple input fields of the web interface are not sanitized properly and
therefore allow an attacker to inject and execute arbitrary OS commands. The
commands are executed with root privileges on the device, allowing to fully
take over the device from the web interface.
Proof of concept:
-----------------
1) Authentication Bypass (CVE-2025-30237)
The authentication bypass is based on the handling of the custom
transport layer encryption, which is used in HTTP and HTTPS connections.
The transport layer encryption is already well known publicly, for example
it is described in the following blog post:
<https://hex.fish/2021/05/10/tp-link-gdpr/>
During authentication the following steps are executed:
1. The client requests RSA parameters and the sequence number
via the /cgi/getParm endpoint.
2. The client provides an AES key and IV to be used for upcoming
encrypted requests.
The web server of the device communicates with the client via
HTTP POST "sign" and "data" parameters. The "sign" parameter
is based on the following data after successful authentication:
[ redacted ]
The "data" parameter contains BASE64 encoded JSON data which is
encrypted that describes the action that should be executed on
the device.
For a login request the "sign" parameter looks slightly different,
since the client and device need to exchange encryption parameters first.
For this purpose the client provides an AES key and IV to the device
via the "sign" parameter during a login request:
[ redacted ]
As an example the following "sign" parameter is valid, given
that the sequence number is valid to the device.
[ redacted ]
An attacker can use the initial "sign" parameter format, with key and IV,
to bypass the authentication, by replacing the "data" parameter
with any action that should be executed on the device.
For example, an attacker is able to create a "Superadmin" user
on the device and enable SSH to gain full access to the device.
Therefore, all examples described in issue 2 "Broken Access Control"
of this advisory are now possible without any authentication.
2) Broken Access Control (CVE-2025-30238)
In order to exploit the broken access control vulnerability an
attacker must be able to create or modify valid requests which
follow the rules of the custom transport layer encryption
that is used by the affected device. For this, an attacker
only needs valid credentials for a low privileged user, who
is able to log in on the web portal of the device. With a valid
session an attacker can then send requests to the device, which
are only meant to be performed by high privileged users on the
device. This includes reading user credentials, enabling SSH or
Telnet and reading CWMP credentials. The following examples
show the unencrypted JSON data that can be sent to the device
in the "data" parameter of a normal action POST request.
Example 1: Creating a Superadmin user
{
"data": {
"X_TP_Grade": "Superadmin",
"username": "$USERNAME",
"password": "$PASSWORD",
[redacted]
},
[redacted]
"isuseractive": true
}
Example 2: Reading User Credentials
{
"data": {
"stack": "0,0,0,0,0,0",
"pstack": "0,0,0,0,0,0"
},
[redacted]
"isuseractive": true
}
Example 3: Enabling SSH
{
"data": {
"localPort": "22",
"sessionLifeTime": "0",
"localEnabled": "1",
[redacted]
},
[redacted]
}
3) Sensitive Data Stored Insecurely (CVE-2025-30239)
The following examples show how the different encrypted
configurations and backups can be decrypted to read plaintext
credentials, including the used passwords.
Example 1: Decryption of Default Configuration
The file "default_configuration.xml" contains the default user
and Wi-Fi credentials in plaintext. This file is also contained in
the firmware update file in the following path:
/etc/default_configuration.xml
The configuration is encrypted using DES-ECB and a static key. The
parameters for decryption are already well-known online. With the
following command the default configuration can be decrypted:
[ PoC removed ]
The resulting file will contain the default plaintext credentials:
<X_TP_UserCfg>
<RootName val=$PLAINTEXT_USERNAME />
<RootPwd val=$PLAINTEXT_PASSWORD />
[...]
</X_TP_UserCfg>
Example 2: Decryption of Active Configuration
The active configuration is stored at an emulated flash memory address.
This file can be found in the following path:
/var/run/misc/misc_rw/0x00200000
The file itself is compressed using BriefLZ and encrypted using
AES-128-CBC and a static key. The AES key and IV can be recovered
by analyzing the libcmm.so and libgdpr.so binaries. The decompression
step can be analyzed via the libcutil.so binary. To recover the
plaintext, the header of the file (first 16 bytes) need to be
discarded. After that the file can be decrypted with the following
command and afterwards decompressed.
[ PoC removed ]
The BriefLZ tool (https://github.com/jibsen/brieflz) can be used for
decompression after a short patch that enables RAW byte support at
a specific offset (4 bytes). For this purpose the the BriefLZ
function blz_depack() can be used.
The resulting file for example contains all configured user
plaintext credentials:
<Users>
<UserNumberOfEntries val=5 />
<User instance=1 >
<RemoteAccessCapable val=1 />
<Username val=$PLAINTEXT_USERNAME />
<Password val=$PLAINTEXT_PASSWORD />
[...]
</User>
Example 3: Decryption of Configuration Backup
A backup can be created in the web portal of the device.
The created backup is encrypted even if no password is set
by the user. The resulting file is called "conf.bin". This
file is compressed and encrypted using DES-ECB with a static
key that is derived from two sources. The backup encryption
is already known online (https://github.com/sta-c0000/tpconf_bin_xml/blob/master/tpconf_bin_xml.py)
and can be used with the correct key. The static key can be
recovered if the following two parts are known:
1. Base key (static bytes embedded in the libcmm.so binary file)
2. Model key (product ID, present in a data model file)
The final key for the backup is created if both parts are
XORed:
Base key (hex) 74************cf
Model key (hex) 35************31
Final key (hex) 41************fe
Using the final key and the tool mentioned the plaintext
can be recovered:
$ python tpconf_bin_xml/tpconf_bin_xml.py -o conf.bin conf.xml
The resulting XML file will contain for example the plaintext
Wi-Fi credentials.
<Security>
<ModeEnabled val=WPA2-WPA3-Personal />
<X_TP_PSKType val=KeyPassphrase />
<PreSharedKey val=$PRESHAREDKEY />
<KeyPassphrase val=$PLAINTEXT_PASSWORD />
<X_TP_WPAWPA2EncryptionMode val=AES />
</Security>
4) Unsafe Symbolic Link Processing (CVE-2025-30240)
Physical access to the device allows an attacker to use the
USB port on the device. For the attacker a USB storage device
needs to be NTFS formatted and a symbolic link created.
The symbolic link can be created via the following command:
$ ln -s / rootfs
If the USB storage device is detected by the device, the symbolic
link will be accessible via the following URL:
http://$IP:8052/sda1/rootfs/
Under this URL the whole file system can be read, including
the active configuration of the device. The active configuration
is accessible via the following path:
/var/run/misc/misc_rw/0x00200000
The configuration itself is encrypted, but can be read via the
proof of concept described in issue 3 "Sensitive Data Stored Insecurely".
5) Authenticated OS Command Injection (CVE-2025-30241)
As a prerequisite, authenticated access to the web interface is needed.
The first vulnerable input is the content user password. It is reachable by
navigating to:
Advanced -> USB Devices -> Sharing Access -> Sharing Account -> Passwor
Severity
No CVSS data available.
Assigner
References
22 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | Multiple TP-Link device series |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0481 (this record)
- related CVE-2025-30237
- related CVE-2025-30238
- related CVE-2025-30239
- related CVE-2025-30240
- related CVE-2025-30241
{
"containers": {
"cna": {
"affected": [
{
"product": "Multiple TP-Link device series",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEC Consult Vulnerability Lab via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20261008-0 \u003e\n=======================================================================\n title: Multiple critical vulnerabilities\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Multiple TP-Link device series\n Mesh: HB Series, HX Series, HC Series; Router: EB Series\n EC Series, EX Series; PON: XC Series, XX Series;\n xDSL modem: VX Series\n vulnerable version: Multiple affected versions\n \u00a0 \u00a0 fixed version: See solution below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-30237, CVE-2025-30238, CVE-2025-30239\n CVE-2025-30240, CVE-2025-30241\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n homepage:https://www.tp-link.com\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2024-12-02\n by: Gerhard Hechenberger (Office Vienna)\n Stefan Schweighofer (Office Vienna)\n Constantin Schieber-Knoebl (Office Vienna)\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos business\n Europe | Asia\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Headquartered in the United States, TP-Link is a global provider of reliable\nnetworking devices and smart home products, consistently ranked as the\nworld\u2019s top provider of Wi-Fi devices. The company is committed to delivering\ninnovative products that enhance people\u2019s lives through faster, more reliable\nconnectivity. With a commitment to excellence, TP-Link serves customers in\nover 170 countries and continues to grow its global footprint.\"\n\nSource:https://www.tp-link.com/us/about/about-us/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patches for multiple affected devices which should be\ninstalled immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Authentication Bypass (CVE-2025-30237)\nThe currently implemented authentication flow of the web server of the\naffected device makes it possible to craft special requests, which allow\nan attacker to directly execute certain actions on the device, without any\nvalid user credentials. This vulnerability makes it possible to execute\nany action that is shown in the \"Broken Access Control\" vulnerability\ndescription without any authentication. Exploiting this, an attacker\ncan effectively take over the device, given that access to the web server\nis possible.\n\n2) Broken Access Control (CVE-2025-30238)\nThe affected device features several user profiles with different\nuser levels. Due to insufficient checks on the device itself, an\nauthenticated attacker can execute actions as low privileged user that\nare meant to be only executed as a high privileged user.\nAn authenticated attacker can therefore create a high privileged user\nprofile and fully take over the device by enabling SSH and logging in\nwith the new account.\n\n3) Sensitive Data Stored Insecurely (CVE-2025-30239)\nThe affected device stores sensitive data in an ineffectively\nprotected format in multiple locations. The used symmetric cryptography\nmakes use of hardcoded keys which are only tied to the device model.\nAfter reversing the firmware and extracting the hardcoded keys,\nan attacker can effectively decrypt the following files and read\nplaintext credentials, including the used passwords. Depending on the\ndevice configuration, CWMP provider credentials can also be extracted.\n- Default Configuration (default user and Wi-Fi credentials)\n- Active Configuration (all user account credentials, Wi-Fi credentials and\n CWMP credentials)\n- Configuration Backup (all user account credentials, Wi-Fi credentials and\n CWMP credentials)\n\n4) Unsafe Symbolic Link Processing (CVE-2025-30240)\nThe USB port on the affected device enables an attacker to\nplace a symbolic link on USB storage devices and gain read access\nto the complete file system of the device.\n\n5) Authenticated OS Command Injection (CVE-2025-30241)\nMultiple input fields of the web interface are not sanitized properly and\ntherefore allow an attacker to inject and execute arbitrary OS commands. The\ncommands are executed with root privileges on the device, allowing to fully\ntake over the device from the web interface.\n\n\nProof of concept:\n-----------------\n1) Authentication Bypass (CVE-2025-30237)\nThe authentication bypass is based on the handling of the custom\ntransport layer encryption, which is used in HTTP and HTTPS connections.\nThe transport layer encryption is already well known publicly, for example\nit is described in the following blog post:\n\u003chttps://hex.fish/2021/05/10/tp-link-gdpr/\u003e\n\nDuring authentication the following steps are executed:\n 1. The client requests RSA parameters and the sequence number\n via the /cgi/getParm endpoint.\n 2. The client provides an AES key and IV to be used for upcoming\n encrypted requests.\n\nThe web server of the device communicates with the client via\nHTTP POST \"sign\" and \"data\" parameters. The \"sign\" parameter\nis based on the following data after successful authentication:\n\n[ redacted ]\n\nThe \"data\" parameter contains BASE64 encoded JSON data which is\nencrypted that describes the action that should be executed on\nthe device.\n\nFor a login request the \"sign\" parameter looks slightly different,\nsince the client and device need to exchange encryption parameters first.\nFor this purpose the client provides an AES key and IV to the device\nvia the \"sign\" parameter during a login request:\n\n[ redacted ]\n\nAs an example the following \"sign\" parameter is valid, given\nthat the sequence number is valid to the device.\n\n[ redacted ]\n\nAn attacker can use the initial \"sign\" parameter format, with key and IV,\nto bypass the authentication, by replacing the \"data\" parameter\nwith any action that should be executed on the device.\n\nFor example, an attacker is able to create a \"Superadmin\" user\non the device and enable SSH to gain full access to the device.\nTherefore, all examples described in issue 2 \"Broken Access Control\"\nof this advisory are now possible without any authentication.\n\n2) Broken Access Control (CVE-2025-30238)\nIn order to exploit the broken access control vulnerability an\nattacker must be able to create or modify valid requests which\nfollow the rules of the custom transport layer encryption\nthat is used by the affected device. For this, an attacker\nonly needs valid credentials for a low privileged user, who\nis able to log in on the web portal of the device. With a valid\nsession an attacker can then send requests to the device, which\nare only meant to be performed by high privileged users on the\ndevice. This includes reading user credentials, enabling SSH or\nTelnet and reading CWMP credentials. The following examples\nshow the unencrypted JSON data that can be sent to the device\nin the \"data\" parameter of a normal action POST request.\n\nExample 1: Creating a Superadmin user\n{\n \"data\": {\n \"X_TP_Grade\": \"Superadmin\",\n \"username\": \"$USERNAME\",\n \"password\": \"$PASSWORD\",\n [redacted]\n },\n [redacted]\n\u00a0 \"isuseractive\": true\n}\n\nExample 2: Reading User Credentials\n{\n \"data\": {\n \"stack\": \"0,0,0,0,0,0\",\n \"pstack\": \"0,0,0,0,0,0\"\n },\n [redacted]\n\u00a0 \"isuseractive\": true\n}\n\nExample 3: Enabling SSH\n{\n \"data\": {\n \"localPort\": \"22\",\n \"sessionLifeTime\": \"0\",\n \"localEnabled\": \"1\",\n [redacted]\n\u00a0 },\n [redacted]\n}\n\n3) Sensitive Data Stored Insecurely (CVE-2025-30239)\nThe following examples show how the different encrypted\nconfigurations and backups can be decrypted to read plaintext\ncredentials, including the used passwords.\n\nExample 1: Decryption of Default Configuration\nThe file \"default_configuration.xml\" contains the default user\nand Wi-Fi credentials in plaintext. This file is also contained in\nthe firmware update file in the following path:\n/etc/default_configuration.xml\n\nThe configuration is encrypted using DES-ECB and a static key. The\nparameters for decryption are already well-known online. With the\nfollowing command the default configuration can be decrypted:\n\n[ PoC removed ]\n\nThe resulting file will contain the default plaintext credentials:\n\n\u003cX_TP_UserCfg\u003e\n \u003cRootName val=$PLAINTEXT_USERNAME /\u003e\n \u003cRootPwd val=$PLAINTEXT_PASSWORD /\u003e\n [...]\n\u003c/X_TP_UserCfg\u003e\n\nExample 2: Decryption of Active Configuration\nThe active configuration is stored at an emulated flash memory address.\nThis file can be found in the following path:\n/var/run/misc/misc_rw/0x00200000\n\nThe file itself is compressed using BriefLZ and encrypted using\nAES-128-CBC and a static key. The AES key and IV can be recovered\nby analyzing the libcmm.so and libgdpr.so binaries. The decompression\nstep can be analyzed via the libcutil.so binary. To recover the\nplaintext, the header of the file (first 16 bytes) need to be\ndiscarded. After that the file can be decrypted with the following\ncommand and afterwards decompressed.\n\n[ PoC removed ]\n\nThe BriefLZ tool (https://github.com/jibsen/brieflz) can be used for\ndecompression after a short patch that enables RAW byte support at\na specific offset (4 bytes). For this purpose the the BriefLZ\nfunction blz_depack() can be used.\n\nThe resulting file for example contains all configured user\nplaintext credentials:\n\n\u003cUsers\u003e\n \u003cUserNumberOfEntries val=5 /\u003e\n \u003cUser instance=1 \u003e\n \u003cRemoteAccessCapable val=1 /\u003e\n \u003cUsername val=$PLAINTEXT_USERNAME /\u003e\n \u003cPassword val=$PLAINTEXT_PASSWORD /\u003e\n[...]\n\u003c/User\u003e\n\nExample 3: Decryption of Configuration Backup\nA backup can be created in the web portal of the device.\nThe created backup is encrypted even if no password is set\nby the user. The resulting file is called \"conf.bin\". This\nfile is compressed and encrypted using DES-ECB with a static\nkey that is derived from two sources. The backup encryption\nis already known online (https://github.com/sta-c0000/tpconf_bin_xml/blob/master/tpconf_bin_xml.py)\nand can be used with the correct key. The static key can be\nrecovered if the following two parts are known:\n1. Base key (static bytes embedded in the libcmm.so binary file)\n2. Model key (product ID, present in a data model file)\n\nThe final key for the backup is created if both parts are\nXORed:\nBase key (hex) 74************cf\nModel key (hex) 35************31\nFinal key (hex) 41************fe\n\nUsing the final key and the tool mentioned the plaintext\ncan be recovered:\n$ python tpconf_bin_xml/tpconf_bin_xml.py -o conf.bin conf.xml\n\nThe resulting XML file will contain for example the plaintext\nWi-Fi credentials.\n\n\u003cSecurity\u003e\n \u003cModeEnabled val=WPA2-WPA3-Personal /\u003e\n \u003cX_TP_PSKType val=KeyPassphrase /\u003e\n \u003cPreSharedKey val=$PRESHAREDKEY /\u003e\n \u003cKeyPassphrase val=$PLAINTEXT_PASSWORD /\u003e\n \u003cX_TP_WPAWPA2EncryptionMode val=AES /\u003e\n\u003c/Security\u003e\n\n4) Unsafe Symbolic Link Processing (CVE-2025-30240)\nPhysical access to the device allows an attacker to use the\nUSB port on the device. For the attacker a USB storage device\nneeds to be NTFS formatted and a symbolic link created.\nThe symbolic link can be created via the following command:\n\n$ ln -s / rootfs\n\nIf the USB storage device is detected by the device, the symbolic\nlink will be accessible via the following URL:\n\nhttp://$IP:8052/sda1/rootfs/\n\nUnder this URL the whole file system can be read, including\nthe active configuration of the device. The active configuration\nis accessible via the following path:\n\n/var/run/misc/misc_rw/0x00200000\n\nThe configuration itself is encrypted, but can be read via the\nproof of concept described in issue 3 \"Sensitive Data Stored Insecurely\".\n\n5) Authenticated OS Command Injection (CVE-2025-30241)\nAs a prerequisite, authenticated access to the web interface is needed.\nThe first vulnerable input is the content user password. It is reachable by\nnavigating to:\n\nAdvanced -\u003e USB Devices -\u003e Sharing Access -\u003e Sharing Account -\u003e Passwor"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:02Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/11"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/11"
},
{
"url": "http://$IP:8052/sda1/rootfs/"
},
{
"url": "https://blog.sec-consult.com"
},
{
"url": "https://github.com/jibsen/brieflz"
},
{
"url": "https://github.com/sta-c0000/tpconf_bin_xml/blob/master/tpconf_bin_xml.py"
},
{
"url": "https://hex.fish/2021/05/10/tp-link-gdpr/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec-consult.com/career/"
},
{
"url": "https://sec-consult.com/contact/"
},
{
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://vulnogram.org/seaview/?CVE-2025-30237"
},
{
"url": "https://vulnogram.org/seaview/?CVE-2025-30238"
},
{
"url": "https://vulnogram.org/seaview/?CVE-2025-30239"
},
{
"url": "https://vulnogram.org/seaview/?CVE-2025-30240"
},
{
"url": "https://vulnogram.org/seaview/?CVE-2025-30241"
},
{
"url": "https://www.sec-consult.com"
},
{
"url": "https://www.tp-link.com"
},
{
"url": "https://www.tp-link.com/us/about/about-us/"
},
{
"url": "https://www.tp-link.com/us/support/faq/5239/"
},
{
"url": "https://x.com/sec_consult"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/11"
],
"discovery": "EXTERNAL"
},
"title": "SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2025-30237",
"type": "related"
},
{
"destId": "CVE-2025-30238",
"type": "related"
},
{
"destId": "CVE-2025-30239",
"type": "related"
},
{
"destId": "CVE-2025-30240",
"type": "related"
},
{
"destId": "CVE-2025-30241",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0481",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/11",
"automated": true,
"contentSha256": "f78e8fa190e3778457c94baa6153c3c891c6dc47dda8b613c9ae05dddb3ec842",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/11",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-08T07:07:30Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0481"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:02Z",
"dateUpdated": "2026-11-02T07:30:02Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0481"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}