This vulnerability involves improper link resolution before file access (CWE-59) in TP-Link Aginet HB810(US2) devices. The affected devices do not properly validate symbolic links created on external USB storage devices. An attacker placing a crafted symbolic link on supported storage media may cause the system to resolve the link, potentially allowing unauthorized reading of sensitive files within the device filesystem. The CVSS 4.0 base score is 5.1, indicating medium severity with attack vector as physical (local), low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

An attacker with physical access to the device's external USB storage can exploit this vulnerability to gain unauthorized read access to sensitive files on the device filesystem. This could lead to exposure of confidential information stored on the device. There is no indication of privilege escalation, integrity, or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict physical access to the device and external USB ports to trusted users only.