← Vulnerability feed

Vulnerability record · CVE-2025-12946 · published 9 December 2025

CVE-2025-12946: Netgear rs700 firmware improper input validation vulnerability

Netgear · Rs700 Firmware

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

4.4 CVSS 4.0 Medium EPSS 0.29% · top 79.9% CWE-20 · Improper input validation
4.4CVSS 4.0 base score
0.29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
18Affected product versions listed by NVD
18References
7 Oct 2026Last modified by NVD

Description

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:

Affected products

18 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory PatchVendor Advisory
https://www.netgear.com/support/product/RAX50 PatchProduct
https://www.netgear.com/support/product/mr90 PatchProduct
https://www.netgear.com/support/product/ms90 PatchProduct
https://www.netgear.com/support/product/rax35v2 PatchProduct
https://www.netgear.com/support/product/rax41 PatchProduct
https://www.netgear.com/support/product/rax41v2 PatchProduct
https://www.netgear.com/support/product/rax42 PatchProduct
https://www.netgear.com/support/product/rax42v2 PatchProduct
https://www.netgear.com/support/product/rax43 PatchProduct
https://www.netgear.com/support/product/rax43v2 PatchProduct
https://www.netgear.com/support/product/rax45 PatchProduct
https://www.netgear.com/support/product/rax49s PatchProduct
https://www.netgear.com/support/product/rax50v2 PatchProduct
https://www.netgear.com/support/product/rax54sv2 PatchProduct
https://www.netgear.com/support/product/raxe450 PatchProduct
https://www.netgear.com/support/product/raxe500 PatchProduct
https://www.netgear.com/support/product/rs700 PatchProduct

Track CVE-2025-12946 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-45613Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.0%9.8CVE-2021-45622Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.4%9.8CVE-2021-45620Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.0%9.8CVE-2021-45614Netgear d7000v2 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.74, LAX20 before 1.1.6.28…EPSS 2.0%9.8CVE-2021-45612Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.5%9.8CVE-2021-45621Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2,…EPSS 2.0%9.8CVE-2021-45616Netgear cbr750 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 3.2.18.2, LAX20 before 1.1.6.28,…EPSS 2.0%8.8CVE-2021-34982Netgear dc112a firmware stack-based buffer overflow vulnerabilityNETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers …EPSS 0.58%

Source: NIST National Vulnerability Database (record CVE-2025-12946), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.