CyberSecBulletin
CVE-2025-12946NVD status: Analyzed

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by…

Published Updated By the CyberSecBulletin desk

CVE-2025-12946 is a high-severity improper input validation vulnerability in RS700 from NETGEAR, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. Affected RS700 versions: 1.0.7.82 and earlier. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.31% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update RAX54Sv2 to V1.1.6.36 or a later version.
  2. Update RAX41v2 to V1.1.6.36 or a later version.
  3. Update RAX50 to V1.2.14.114 or a later version.
  4. Read the advisory on kb.netgear.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
NETGEARRS7001.0.7.82 and earlierNot stated
NETGEARRAX54Sv2before V1.1.6.36V1.1.6.36
NETGEARRAX41v2before V1.1.6.36V1.1.6.36
NETGEARRAX50before V1.2.14.114V1.2.14.114
NETGEARRAXE500before V1.2.14.114V1.2.14.114
NETGEARRAX41before V1.0.17.142V1.0.17.142
NETGEARRAX43before V1.0.17.142V1.0.17.142
NETGEARRAX35v2before V1.0.17.142V1.0.17.142
NETGEARRAXE450before V1.2.14.114V1.2.14.114
NETGEARRAX43v2before V1.1.6.36V1.1.6.36
NETGEARRAX42before V1.0.17.142V1.0.17.142
NETGEARRAX45before V1.0.17.142V1.0.17.142
NETGEARRAX50v2before V1.1.6.36V1.1.6.36
NETGEARMR90before V1.0.2.46V1.0.2.46
NETGEARRAX42v2before V1.1.6.36V1.1.6.36
NETGEARRAX49Sbefore V1.1.6.36V1.1.6.36
NETGEARMS90before V1.0.2.46V1.0.2.46
NETGEARRs700 Firmwarebefore 1.0.9.61.0.9.6
NETGEARRax54sv2 Firmwarebefore 1.1.6.361.1.6.36
NETGEARRax45v2 Firmwarebefore 1.1.6.361.1.6.36
NETGEARRax41v2 Firmwarebefore 1.1.6.361.1.6.36
NETGEARRax50 Firmwarebefore 1.2.14.1141.2.14.114
NETGEARRaxe500 Firmwarebefore 1.2.14.1141.2.14.114
NETGEARRax41 Firmwarebefore 1.0.17.1421.0.17.142
NETGEARRax43 Firmwarebefore 1.0.17.1421.0.17.142

Version data comes from the organisation that assigned the CVE; 10 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.04.4MediumCNA
CVSS 3.17.5HighNVD

Official description

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

How developers prevent this class of flaw

  • Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build recognizers for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses.
  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

More Improper Input Validation vulnerabilities (CWE-20)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Input Validation vulnerabilities

Spotted an error? Tell us.