Log in Start free

Vulnerability · Published Dec 9, 2025 · Assigned by NETGEAR

CVE-2025-12946Improper input validation in NETGEAR Nighthawk routers

Medium 4.4

In plain English

A medium-severity improper input validation in MR90 from NETGEAR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)4.4Medium
Exploit odds (30 days)0.3%top 78.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

Affected products (as reported)

VendorProductVersions
NETGEAR RS700 0 – through 1.0.7.82
NETGEAR RAX54Sv2 0 – before V1.1.6.36
NETGEAR RAX41v2 0 – before V1.1.6.36
NETGEAR RAX50 0 – before V1.2.14.114
NETGEAR RAXE500 0 – before V1.2.14.114
NETGEAR RAX41 0 – before V1.0.17.142
NETGEAR RAX43 0 – before V1.0.17.142
NETGEAR RAX35v2 0 – before V1.0.17.142
NETGEAR RAXE450 0 – before V1.2.14.114
NETGEAR RAX43v2 0 – before V1.1.6.36
NETGEAR RAX42 0 – before V1.0.17.142
NETGEAR RAX45 0 – before V1.0.17.142
NETGEAR RAX50v2 0 – before V1.1.6.36
NETGEAR MR90 0 – before V1.0.2.46
NETGEAR RAX42v2 0 – before V1.1.6.36
NETGEAR RAX49S 0 – before V1.1.6.36
NETGEAR MS90 0 – before V1.0.2.46

Weakness: CWE-20 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:A/V:D/RE:M/U:Amber

References