CVE-2025-12946
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: Netgear, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netgear | nighthawk_router | raxe450 |
| netgear | nighthawk_router | rax41 |
| netgear | nighthawk_router | rax45 |
| netgear | nighthawk_router | rax50v2 |
| netgear | nighthawk_router | rax42 |
| netgear | nighthawk_router | mr90 |
| netgear | nighthawk_router | * |
| netgear | nighthawk_router | rax43v2 |
| netgear | nighthawk_router | rs700 |
| netgear | nighthawk_router | raxe500 |
| netgear | nighthawk_router | rax41v2 |
| netgear | nighthawk_router | rax50 |
| netgear | nighthawk_router | rax43 |
| netgear | nighthawk_router | rax35v2 |
| netgear | nighthawk_router | ms90 |
| netgear | nighthawk_router | rax42v2 |
| netgear | nighthawk_router | rax49s |
| netgear | nighthawk_router | rax54sv2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the speedtest feature of certain NETGEAR Nighthawk routers. It is caused by improper input validation, which allows attackers on the router's WAN side to use man-in-the-middle (MiTM) techniques to manipulate DNS responses. This manipulation can lead to the execution of arbitrary commands when speedtests are run on the affected routers.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could execute arbitrary commands on the affected router by manipulating DNS responses during speedtests. This could lead to unauthorized control over the router, potentially compromising network security, disrupting internet connectivity, or enabling further attacks within the network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your NETGEAR Nighthawk router firmware to the fixed versions listed for your model. Avoid running the speedtest feature from the WAN side until the update is applied. Additionally, protect your network against man-in-the-middle (MiTM) attacks by securing DNS responses, for example by using DNS over HTTPS or DNSSEC if supported, and restrict WAN-side access to the router's management interfaces.