NETGEAR R7000P CVE-2025-12945

Exploitation requires three simultaneous conditions: (1) the attacker must have authenticated administrator-level credentials to the router (PR:H per CVSS), eliminating unauthenticated remote exploitation; (2) the attacker must be on the same local network segment as the router (AV:A per CVSS - not reachable from the internet); and (3) the target device must be a NETGEAR R7000P running firmware through version 1.3.3.154. There is no user interaction required once admin access is established. The limiting factors - administrative authentication and adjacent-network requirement - substantially reduce the realistic attacker pool to insiders, attackers who have already compromised a device on the local network, or those who have separately obtained admin credentials through other means.

The real-world risk of this vulnerability is very low. The CVSS 4.0 base score of 1.1 accurately reflects the stacked requirements: the attacker must already hold administrator credentials (PR:H), must be on the local network (AV:A), and the impact is limited to low-integrity modification with no confidentiality or availability consequence. The E:U (Unexploited) supplemental metric confirms no known exploitation. No EPSS score was provided in the source data, but given the constrained attack surface, exploitation probability is expected to be negligible. There is no KEV listing and no public proof-of-concept. The primary real-world concern is that the R7000P is end-of-service: users who do not apply the available patch have no future remediation path through the vendor. For a threat actor who already has admin credentials on the local network, the marginal utility of this vulnerability (integrity-only, no remote vector) is low compared to what they could already accomplish with that access level.

An attacker who has already obtained administrator credentials to the R7000P - through credential reuse, phishing, or prior compromise of a device on the same local network - navigates to a vulnerable input field in the router's web admin panel and injects OS commands alongside legitimate input. The router firmware fails to sanitize the input and executes the injected commands, allowing the attacker to alter router configuration, redirect DNS, or modify firmware behavior. No public proof-of-concept is known, and the attack requires local network adjacency.