Is there a patch available for CVE-2025-12945?

Yes, a patch is available for CVE-2025-12945. Update the affected software to the latest version immediately.

NETGEAR R7000P CVE-2025-12945

Q: What is the CVSS score of CVE-2025-12945?

CVE-2025-12945 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber. EPSS exploitation probability: 1.8%.

LOW

Improper Input Validation (CWE-20)

2025-12-09 a2826606-91e7-4eb6-899e-8484bd4575d5

Command Injection Netgear R7000P Firmware

1.1

CVSS 4.0 · Vendor: a2826606-91e7-4eb6-899e-8484bd4575d5

Severity by source

Vendor (a2826606-91e7-4eb6-899e-8484bd4575d5) PRIMARY

1.1 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber

vuln.today AI

2.4 LOW

Adjacent vector and high privileges required (local admin); integrity-only impact with no confidentiality or availability effect per description.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (a2826606-91e7-4eb6-899e-8484bd4575d5).

CVSS VectorVendor: a2826606-91e7-4eb6-899e-8484bd4575d5

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 26, 2026 - 17:38 vuln.today

DescriptionCVE.org

An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability.

This issue affects R7000P: through 1.3.3.154.

AnalysisAI

OS command injection in the NETGEAR Nighthawk R7000P router firmware (through version 1.3.3.154) allows an authenticated administrator with local network access to execute arbitrary OS commands and make unauthorized modifications to router software and functionality. The impact is limited strictly to integrity - confidentiality and availability are unaffected. The device is end-of-service, meaning ongoing support is limited, and NETGEAR has released a patch via its December 2025 security advisory. No public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

The affected component is the R7000P firmware, identified by CPE cpe:2.3:o:netgear:r7000p_firmware:*:*:*:*:*:*:*:*, covering all versions through 1.3.3.154. The root cause is CWE-20 (Improper Input Validation): the router's administrative interface fails to properly sanitize inputs before passing them to an underlying OS shell, enabling command injection. This class of vulnerability in embedded router firmware typically manifests in web-based admin panels or command-line management interfaces where user-supplied values (e.g., DNS server fields, hostnames, or diagnostic tool parameters) are interpolated into shell commands without escaping. The adjacent-network attack vector (CVSS AV:A) reflects that the router's admin interface is accessible only from the local network segment, not the internet.

RemediationAI

The primary fix is to apply the firmware update available through NETGEAR's product support page at https://www.netgear.com/support/product/r7000p, as documented in the December 2025 NETGEAR Security Advisory (https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory). No exact patched firmware version number is confirmed from available data beyond 'patch available per vendor advisory.' Because the R7000P is end-of-service, users should verify they are running the latest available firmware and consider device replacement as a longer-term control. As a compensating control, restrict access to the router's administrative interface by ensuring management access is limited to trusted hosts only (disable remote management if enabled) and enforce strong, unique administrator credentials to reduce the risk of unauthorized admin-level access, which is the prerequisite for exploitation.