CVE-2025-30239 is a vulnerability in TP-Link HB810(US2) devices where hardcoded cryptographic keys are used within the firmware to protect sensitive configuration data. An attacker with access to the device's storage can extract these keys and decrypt stored sensitive information such as credentials and service-related data. This weakness corresponds to CWE-321 (Use of Hard-coded Cryptographic Key). The CVSS 4.0 vector indicates the attack requires adjacent network access with low complexity and low privileges, but results in high confidentiality and integrity impact. No official fix or patch has been documented as of the published date.

Successful exploitation allows an attacker with access to device storage to recover hardcoded cryptographic keys and decrypt sensitive configuration data. This can lead to exposure of credentials and service-related information, potentially compromising device security and associated services. The vulnerability is rated high severity with a CVSS score of 8.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical and network access to the affected devices to prevent unauthorized access to device storage. Monitor vendor channels for updates regarding patches or mitigations.