{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12946", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "state": "PUBLISHED", "assignerShortName": "NETGEAR", "dateReserved": "2025-11-10T08:26:32.586Z", "datePublished": "2025-12-09T17:02:20.739Z", "dateUpdated": "2025-12-10T04:57:22.798Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Speedtest"], "product": "RS700", "vendor": "NETGEAR", "versions": [{"lessThanOrEqual": "1.0.7.82", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX54Sv2", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.1.6.36", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX41v2", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.1.6.36", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX50", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.2.14.114", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAXE500", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.2.14.114", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX41", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.0.17.142", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX43", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.0.17.142", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX35v2", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.0.17.142", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAXE450", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.2.14.114", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX43v2", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.1.6.36", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX42", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.0.17.142", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX45", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.0.17.142", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX50v2", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.1.6.36", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "MR90", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.0.2.46", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX42v2", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.1.6.36", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX49S", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.1.6.36", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "MS90", "vendor": "NETGEAR", "versions": [{"lessThan": "V1.0.2.46", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rs700:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.0.7.82", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax54sv2:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax41v2:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax50:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.2.14.114", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:raxe500:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.2.14.114", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax41:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax43:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax35v2:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:raxe450:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.2.14.114", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax43v2:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax42:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax45:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax50v2:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:mr90:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.0.2.46", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax42v2:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax49s:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:ms90:*:*:*:*:*:*:*:*", "versionEndExcluding": "v1.0.2.46", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "molybdenum"}], "datePublic": "2025-12-09T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><div><div><p></p><div><div><p>A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. </p></div><div><p>This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46;\u202fRAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36. </p></div></div><p></p></div></div><br><p></p>"}], "value": "A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. \n\n\n\nThis issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46;\u202fRAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36."}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "AUTOMATIC", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 4.4, "baseSeverity": "MEDIUM", "exploitMaturity": "UNREPORTED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:A/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2025-12-09T19:35:39.538Z"}, "references": [{"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rs700"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax54sv2"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax41v2"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/RAX50"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/raxe500"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax41"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax43"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax35v2"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/raxe450"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax43v2"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax42"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax45"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax50v2"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/mr90"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/ms90"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax42v2"}, {"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/rax49s"}, {"tags": ["vendor-advisory"], "url": "https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Devices with automatic updates enabled may already have\nthis patch applied. If not, please check the firmware version and update it to\nthe latest.<br>\n<br>\n</p>\n\n<p>Fixed in:</p><p>RS700 firmware V1.0.9.6 or later</p><p>RAX54Sv2/RAX45v2&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax54sv2\">firmware&nbsp;V1.1.6.36 or later</a></p><p>RAX41v2&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax41v2\">firmware V1.1.6.36 or later</a></p><p>RAX50&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX50\">firmware V1.2.14.114 or later</a></p><p>RAXE500&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/raxe500\">firmware V1.2.14.114&nbsp;or later</a></p><p>RAX41 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax41\">firmware V1.0.17.142 or later</a></p><p>RAX43 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax43\">firmware V1.0.17.142 or later</a></p><p>RAX35v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX35v2\">firmware V1.0.17.142 or later</a></p><p>RAXE450 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAXE450\">firmware V1.0.17.142 or later</a></p><p>RAX43v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX43v2\">firmware V1.1.6.36 or later</a></p><p>RAX42 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX42\">firmware V1.0.17.142 or later</a></p><p>RAX45&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX45\">firmware V1.0.17.142 or later</a></p><p>RAX50v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX50v2\">firmware V1.1.6.36 or later</a></p><p>MR90 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/MR90\">firmware V1.0.2.46 or later</a></p><p>MS90 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/MS90\">firmware V1.0.2.46 or later</a></p><p>RAX42v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX42v2\">firmware V1.1.6.36 or later</a></p><p>RAX49S <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX42v2\">firmware V1.1.6.36 or later</a><br></p>"}], "value": "Devices with automatic updates enabled may already have\nthis patch applied. If not, please check the firmware version and update it to\nthe latest.\n\n\n\n\n\n\n\nFixed in:\n\nRS700 firmware V1.0.9.6 or later\n\nRAX54Sv2/RAX45v2\u00a0 firmware\u00a0V1.1.6.36 or later https://www.netgear.com/support/product/rax54sv2 \n\nRAX41v2\u00a0 firmware V1.1.6.36 or later https://www.netgear.com/support/product/rax41v2 \n\nRAX50\u00a0 firmware V1.2.14.114 or later https://www.netgear.com/support/product/RAX50 \n\nRAXE500\u00a0 firmware V1.2.14.114\u00a0or later https://www.netgear.com/support/product/raxe500 \n\nRAX41 firmware V1.0.17.142 or later https://www.netgear.com/support/product/rax41 \n\nRAX43 firmware V1.0.17.142 or later https://www.netgear.com/support/product/rax43 \n\nRAX35v2 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX35v2 \n\nRAXE450 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAXE450 \n\nRAX43v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX43v2 \n\nRAX42 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX42 \n\nRAX45\u00a0 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX45 \n\nRAX50v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX50v2 \n\nMR90 firmware V1.0.2.46 or later https://www.netgear.com/support/product/MR90 \n\nMS90 firmware V1.0.2.46 or later https://www.netgear.com/support/product/MS90 \n\nRAX42v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX42v2 \n\nRAX49S firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX42v2"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2025-12-09T16:00:00.000Z", "value": "published"}], "title": "Improper input validation in NETGEAR Nighthawk routers", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-12946"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-10T04:57:22.798Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12946", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T20:22:10.139647Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T20:22:16.677Z"}}], "cna": {"title": "Improper input validation in NETGEAR Nighthawk routers", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "molybdenum"}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 4.4, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:A/V:D/RE:M/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NETGEAR", "modules": ["Speedtest"], "product": "RS700", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.7.82"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX54Sv2", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.6.36", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX41v2", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.6.36", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX50", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.2.14.114", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAXE500", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.2.14.114", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX41", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0.17.142", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX43", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0.17.142", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX35v2", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0.17.142", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAXE450", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.2.14.114", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX43v2", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.6.36", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX42", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0.17.142", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX45", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0.17.142", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX50v2", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.6.36", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "MR90", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0.2.46", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX42v2", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.6.36", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX49S", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.6.36", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "MS90", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0.2.46", "versionType": "custom"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-09T16:00:00.000Z", "value": "published"}], "solutions": [{"lang": "en", "value": "Devices with automatic updates enabled may already have\nthis patch applied. If not, please check the firmware version and update it to\nthe latest.\n\n\n\n\n\n\n\nFixed in:\n\nRS700 firmware V1.0.9.6 or later\n\nRAX54Sv2/RAX45v2\u00a0 firmware\u00a0V1.1.6.36 or later https://www.netgear.com/support/product/rax54sv2 \n\nRAX41v2\u00a0 firmware V1.1.6.36 or later https://www.netgear.com/support/product/rax41v2 \n\nRAX50\u00a0 firmware V1.2.14.114 or later https://www.netgear.com/support/product/RAX50 \n\nRAXE500\u00a0 firmware V1.2.14.114\u00a0or later https://www.netgear.com/support/product/raxe500 \n\nRAX41 firmware V1.0.17.142 or later https://www.netgear.com/support/product/rax41 \n\nRAX43 firmware V1.0.17.142 or later https://www.netgear.com/support/product/rax43 \n\nRAX35v2 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX35v2 \n\nRAXE450 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAXE450 \n\nRAX43v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX43v2 \n\nRAX42 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX42 \n\nRAX45\u00a0 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX45 \n\nRAX50v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX50v2 \n\nMR90 firmware V1.0.2.46 or later https://www.netgear.com/support/product/MR90 \n\nMS90 firmware V1.0.2.46 or later https://www.netgear.com/support/product/MS90 \n\nRAX42v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX42v2 \n\nRAX49S firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX42v2", "supportingMedia": [{"type": "text/html", "value": "<p>Devices with automatic updates enabled may already have\nthis patch applied. If not, please check the firmware version and update it to\nthe latest.<br>\n<br>\n</p>\n\n<p>Fixed in:</p><p>RS700 firmware V1.0.9.6 or later</p><p>RAX54Sv2/RAX45v2&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax54sv2\">firmware&nbsp;V1.1.6.36 or later</a></p><p>RAX41v2&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax41v2\">firmware V1.1.6.36 or later</a></p><p>RAX50&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX50\">firmware V1.2.14.114 or later</a></p><p>RAXE500&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/raxe500\">firmware V1.2.14.114&nbsp;or later</a></p><p>RAX41 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax41\">firmware V1.0.17.142 or later</a></p><p>RAX43 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rax43\">firmware V1.0.17.142 or later</a></p><p>RAX35v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX35v2\">firmware V1.0.17.142 or later</a></p><p>RAXE450 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAXE450\">firmware V1.0.17.142 or later</a></p><p>RAX43v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX43v2\">firmware V1.1.6.36 or later</a></p><p>RAX42 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX42\">firmware V1.0.17.142 or later</a></p><p>RAX45&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX45\">firmware V1.0.17.142 or later</a></p><p>RAX50v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX50v2\">firmware V1.1.6.36 or later</a></p><p>MR90 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/MR90\">firmware V1.0.2.46 or later</a></p><p>MS90 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/MS90\">firmware V1.0.2.46 or later</a></p><p>RAX42v2 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX42v2\">firmware V1.1.6.36 or later</a></p><p>RAX49S <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/RAX42v2\">firmware V1.1.6.36 or later</a><br></p>", "base64": false}]}], "datePublic": "2025-12-09T17:00:00.000Z", "references": [{"url": "https://www.netgear.com/support/product/rs700", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax54sv2", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax41v2", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/RAX50", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/raxe500", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax41", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax43", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax35v2", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/raxe450", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax43v2", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax42", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax45", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax50v2", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/mr90", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/ms90", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax42v2", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/rax49s", "tags": ["product", "patch"]}, {"url": "https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. \n\n\n\nThis issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46;\u202fRAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.", "supportingMedia": [{"type": "text/html", "value": "<p></p><div><div><p></p><div><div><p>A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. </p></div><div><p>This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46;\u202fRAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36. </p></div></div><p></p></div></div><br><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rs700:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.0.7.82", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax54sv2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax41v2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax50:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.2.14.114", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:raxe500:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.2.14.114", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax41:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax43:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax35v2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:raxe450:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.2.14.114", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax43v2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax42:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax45:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.0.17.142", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax50v2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:mr90:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.0.2.46", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax42v2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax49s:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.1.6.36", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:ms90:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "v1.0.2.46", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2025-12-09T19:35:39.538Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12946", "state": "PUBLISHED", "dateUpdated": "2025-12-09T20:43:57.176Z", "dateReserved": "2025-11-10T08:26:32.586Z", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "datePublished": "2025-12-09T17:02:20.739Z", "assignerShortName": "NETGEAR"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rs700_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3AE8FD9-1FC9-4DF0-B22B-B482980EEDA8", "versionEndExcluding": "1.0.9.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rs700:-:*:*:*:*:*:*:*", "matchCriteriaId": "20BFC36A-1819-4878-A004-9851290B203F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax54sv2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "83DB8165-F9DC-4086-91AF-9C4298FECBCC", "versionEndExcluding": "1.1.6.36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax54sv2:-:*:*:*:*:*:*:*", "matchCriteriaId": "B9FCC230-8A49-4C8C-BB53-DD703996F4DA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax45v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F6C69CA-30D0-4753-915B-9E5A15F10E2A", "versionEndExcluding": "1.1.6.36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax45v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD5E8B48-66CB-4D9B-89C3-DA5F1A7B74F3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax41v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEC93BCF-E89C-49A9-9631-1666E6FF4E21", "versionEndExcluding": "1.1.6.36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax41v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "138DD7E4-528F-4984-ACD7-E18379C4FF7C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax50_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "24ADEE5B-3DA1-4BA7-99BC-64746B6E797A", "versionEndExcluding": "1.2.14.114", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax50:-:*:*:*:*:*:*:*", "matchCriteriaId": "C430976E-24C0-4EA7-BF54-F9C188AB9C01", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:raxe500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B75B005E-469A-4AB4-A0F5-D0067D66FFA3", "versionEndExcluding": "1.2.14.114", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:raxe500:-:*:*:*:*:*:*:*", "matchCriteriaId": "6D23ADF0-05B4-4163-9666-3F470FB19E01", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax41_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "26F72A55-78AE-47E4-B18B-E042FC3B2EC6", "versionEndExcluding": "1.0.17.142", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax41:-:*:*:*:*:*:*:*", "matchCriteriaId": "C52C7C17-08C5-47CE-A5D5-640C6B9DB82C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax43_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C774BE3-68EE-4FAB-91AF-F62BB671AE49", "versionEndExcluding": "1.0.17.142", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax43:-:*:*:*:*:*:*:*", "matchCriteriaId": "178BB386-F66C-4CE8-9283-37D22B304691", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax35v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "272325DB-336A-4278-A6B9-07B0FF413C85", "versionEndExcluding": "1.0.17.142", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax35v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "9358B2F2-D24E-434D-AEE5-6CE093598793", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:raxe450_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6B5D898-8F61-429C-A092-4A3B1730E40D", "versionEndExcluding": "1.0.17.142", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:raxe450:-:*:*:*:*:*:*:*", "matchCriteriaId": "67D7EC2C-E443-4749-854E-5BC057CA6B06", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax43v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "01763B66-6177-4EDC-BD12-54D931DFDB2F", "versionEndExcluding": "1.1.6.36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax43v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "6E165736-5E8D-4DDB-B157-99723FE20BD2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax42_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7838CEA1-0B9F-40B7-AE11-567E9223F011", "versionEndExcluding": "1.0.17.142", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax42:-:*:*:*:*:*:*:*", "matchCriteriaId": "D83182AB-E726-4371-B092-FA1920408FED", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax45_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C93981C6-FF9B-46D2-836A-CFAF47EC87FF", "versionEndExcluding": "1.0.17.142", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax45:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B08BD69-CDCC-4CEB-B887-4E47D2B45D26", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax50v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "92ED39F8-F270-46EA-8947-F855FEFD5CF5", "versionEndExcluding": "1.1.6.36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax50v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "59381950-4DC4-4FD7-B3DB-D950DDA5C591", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:mr90_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC405D96-56D5-437D-9F9A-B101981BEED1", "versionEndExcluding": "1.0.2.46", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:mr90:-:*:*:*:*:*:*:*", "matchCriteriaId": "37B02AF9-8E7C-4916-8D7A-7A920AB95593", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:ms90_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B0D8D94-1B29-4629-BC9F-29F18E3A13FA", "versionEndExcluding": "1.0.2.46", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:ms90:-:*:*:*:*:*:*:*", "matchCriteriaId": "5C6AA9FB-3B52-450A-9DF5-CBD32CA17ED3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax42v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "23B8F4EF-7E41-4686-9138-77FE95114F8B", "versionEndExcluding": "1.1.6.36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax42v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "D61EA1E9-FB8C-4E79-8A07-7B5E79DCB70A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax49s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAC35BB2-E9D2-4097-BA74-3FDCFD83741B", "versionEndExcluding": "1.1.6.36", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax49s:-:*:*:*:*:*:*:*", "matchCriteriaId": "85511EF7-8F04-4DB7-8CF3-2F888A0A94C5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. \n\n\n\nThis issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46;\u202fRAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36."}], "id": "CVE-2025-12946", "lastModified": "2026-01-21T19:29:14.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "AUTOMATIC", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}]}, "published": "2025-12-09T17:15:48.820", "references": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Vendor Advisory"], "url": "https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/RAX50"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/mr90"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/ms90"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax35v2"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax41"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax41v2"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax42"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax42v2"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax43"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax43v2"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax45"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax49s"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax50v2"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rax54sv2"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/raxe450"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/raxe500"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/rs700"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}