CVE-2025-12946

No fix known EPSS <1%CVSS 4.4

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

Published 2025-12-09 · CVE record · OSV

Products: NETGEAR RS700, NETGEAR RAX54Sv2, NETGEAR RAX41v2, NETGEAR RAX50, NETGEAR RAXE500, NETGEAR RAX41, NETGEAR RAX43, NETGEAR RAX35v2, NETGEAR RAXE450, NETGEAR RAX43v2, NETGEAR RAX42, NETGEAR RAX45, NETGEAR RAX50v2, NETGEAR MR90, NETGEAR RAX42v2, NETGEAR RAX49S, NETGEAR MS90