CVE-2025-30237 describes a missing authorization vulnerability (CWE-862) in TP-Link Systems Inc. HB810(US2) devices, specifically versions V1.0, 1.6, 2.0, and 2.6. The issue arises because the web management interface does not consistently enforce authentication checks on certain sensitive endpoints. An attacker can send crafted requests to bypass authentication and invoke privileged functionality without valid credentials, potentially gaining full control of the device. The CVSS 4.0 vector indicates the attack requires adjacent network access, has low attack complexity, no privileges or user interaction needed, and results in high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can bypass access controls on the device's web management interface and execute privileged operations. This can lead to full compromise of the device, including unauthorized configuration changes, disruption of service, or other malicious activities. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks.