CVE-2025-12946High· 7.5▾ TwilightA vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run.
This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.
rs700_firmware < 1.0.9.6rax54sv2_firmware < 1.1.6.36rax45v2_firmware < 1.1.6.36rax41v2_firmware < 1.1.6.36rax50_firmware < 1.2.14.114raxe500_firmware < 1.2.14.114rax41_firmware < 1.0.17.142rax43_firmware < 1.0.17.142rax35v2_firmware < 1.0.17.142raxe450_firmware < 1.0.17.142rax43v2_firmware < 1.1.6.36rax42_firmware < 1.0.17.142rax45_firmware < 1.0.17.142rax50v2_firmware < 1.1.6.36mr90_firmware < 1.0.2.46ms90_firmware < 1.0.2.46rax42v2_firmware < 1.1.6.36rax49s_firmware < 1.1.6.36Upgrade past the affected range:
rs700_firmware 1.0.9.6rax54sv2_firmware 1.1.6.36rax45v2_firmware 1.1.6.36rax41v2_firmware 1.1.6.36rax50_firmware 1.2.14.114raxe500_firmware 1.2.14.114rax41_firmware 1.0.17.142rax43_firmware 1.0.17.142rax35v2_firmware 1.0.17.142raxe450_firmware 1.0.17.142rax43v2_firmware 1.1.6.36rax42_firmware 1.0.17.142rax45_firmware 1.0.17.142rax50v2_firmware 1.1.6.36mr90_firmware 1.0.2.46ms90_firmware 1.0.2.46rax42v2_firmware 1.1.6.36rax49s_firmware 1.1.6.36Connected by shared product, vendor, weakness, or advisory.
CVE-2025-12945Low· 2.4An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modif…
CVE-2026-9218Medium· 4.5Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized co…
CVE-2026-11732High· 8.8An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized comm…
CVE-2026-107918Medium· 4.5Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified throu…
CVE-2026-107917Medium· 4.5Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified th…
CVE-2025-12941Medium· 5.7Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the router.