NETGEAR Nighthawk
CVE-2025-12946
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain WAN-side network position
-
DeliveryPerform MiTM and spoof DNS responses
-
ExploitVictim runs router speedtest
-
ExecutionInject unvalidated input via forged response
-
ImpactExecute commands on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires the attacker to be on the router's WAN side and capable of an active attacker-in-the-middle attack to manipulate DNS responses (AV:A, AT:P). Exploitation only triggers when a user actively runs the router's built-in speedtest feature (UI:A) - it is not autonomous. No authentication is needed (PR:N), but the combination of a privileged upstream network position plus required victim action (AC:H) sharply limits realistic exploitation to targeted scenarios. Affects specific Nighthawk models below the fixed firmware (e.g., RAX50 before V1.2.14.114, RS700 through 1.0.7.82, RAX41 before V1.0.17.142) - patched firmware is available. |
| Impact | This is a genuinely dangerous technical impact (command execution on the router, reflected as VC:H/VI:H/VA:H in the CVSS 4.0 vector) but wrapped in significant exploitation friction, which is why the base score lands at only 4.4/MEDIUM. The attacker must be positioned on the router's WAN side and able to run an attacker-in-the-middle attack to manipulate DNS responses (AV:A adjacent, AT:P attack-requirement present, AC:H high complexity), and the victim must actively trigger a speedtest (UI:A). No privileges are required (PR:N). Corroborating signals point to low real-world urgency rather than active threat: EPSS is 0.29% (20th percentile), the CVSS 4.0 exploit-maturity metric is E:U (unreported/no known exploit), there is no CISA KEV listing, and no public POC is referenced. The vendor tag 'Information Disclosure' UNDERSTATES the flaw - the vector shows full integrity and availability impact (VI:H/VA:H) consistent with command execution, not mere disclosure. Net: treat as a patch-on-normal-cadence item. The high technical impact keeps it above trivial, but the WAN-side MiTM prerequisite plus required user interaction make widespread opportunistic exploitation unlikely; realistic risk is targeted attackers already able to intercept a victim's upstream traffic (e.g., a malicious ISP-path or compromised upstream node). |
| Exploit ScenarioDerived | An attacker who can intercept the router's upstream (WAN-side) traffic and forge DNS responses waits for or induces the user to run the built-in speedtest. When the speedtest resolves and contacts its server, the manipulated DNS response and unvalidated input let the attacker inject and execute commands on the router. No public exploit code is identified at time of analysis, and the attack requires both a privileged network position and victim action. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Command execution and information disclosure in the built-in speedtest feature of multiple NETGEAR Nighthawk routers (RAX/RAXE/MR/MS/RS700 families) allows an attacker positioned on the router's WAN side to conduct an active attacker-in-the-middle attack, spoof DNS responses, and have malicious commands executed when the router's speedtest is run. Exploitation is not autonomous: it requires a privileged upstream network position plus the victim actively triggering a speedtest, which is why the assessed severity is only 4.4/MEDIUM despite high confidentiality, integrity, and availability impact on the device. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); EPSS is very low at 0.29% (20th percentile), consistent with a targeted rather than opportunistic threat. Vendor-released fixed firmware is available for the affected models.
RemediationAI
Apply the vendor's fixed firmware per model: RAX50, RAXE500 and RAXE450 to V1.2.14.114 or later; RAX41, RAX43, RAX35v2, RAX42 and RAX45 to V1.0.17.142 or later; RAX54Sv2, RAX41v2, RAX43v2, RAX50v2, RAX42v2 and RAX49S to V1.1.6.36 or later; MR90 and MS90 to V1.0.2.46 or later; RS700 is documented as affected through 1.0.7.82, so check the December 2025 NETGEAR Security Advisory (https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory) and the RS700 support page for the current fixed release before assuming a safe version. Firmware updates should be pulled over the router's LAN/administrative interface rather than trusted from a WAN-side source, and where auto-update is enabled, verify the advertised version matches the vendor advisory. Because the attack requires DNS manipulation from the WAN side and a user-initiated speedtest, effective compensating controls are to stop initiating the router's built-in speedtest (from the web UI, Nighthawk app, or any automation that triggers it) until patched - this removes the trigger entirely at the cost of losing the device's speed measurement feature; and to place the router behind a trusted upstream resolver/DNS-over-HTTPS or a filtered gateway so that forged DNS answers to the router are rejected, which reduces MITM feasibility but does not fix the underlying validation flaw. Disabling remote management on the WAN interface and ensuring the router's DNS settings point to resolvers the attacker cannot spoof (e.g., DoH/DoT-capable upstream) further narrows the window. Reboot/rotation of router credentials is advisable if a speedtest was run while on an untrusted ISP or captive network, since successful exploitation yields command execution with high confidentiality, integrity and availability impact on the device itself.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is improper input validation (CWE-20) in the speedtest component of the affected NETGEAR Nighthawk firmware. The speedtest routine resolves and communicates with test endpoints, and the firmware fails to adequately validate the responses it receives, so an adversary who can manipulate DNS answers on the WAN side (active man-in-the-middle, reflected in the assessed vector as AV:A with AT:P) can feed crafted data back into a path that results in command execution on the device. The CVSS 4.0 vector (CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and the independent CVSS 3.1 assessment (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) agree on the shape of the issue: the attacker needs an adjacent/upstream network foothold and an active MITM capability, no authentication to the router is required, but the victim must actively invoke the speedtest (UI:A / UI:R) for the vulnerable code path to execute. Only the router itself is impacted - subsequent system (SC/SI/SA) metrics are None - so the consequence is full compromise of the device rather than lateral movement inherent to the flaw. Affected firmware images span the RS700, RAX54Sv2, RAX45v2, RAX41v2, RAX50, RAXE500, RAX41, RAX43, RAX35v2, RAXE450, RAX43v2, RAX42, RAX45, RAX50v2, MR90, MS90, RAX42v2, and RAX49S product lines, as enumerated in the CPE data.
Know when Rax50 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:A/V:D/RE:M/U:Amber
AV:A and AC:H because a WAN-side MiTM with DNS manipulation is required; UI:R because a user must run the speedtest; C/I/A:H for router command execution.
Primary rating from Vendor (a2826606-91e7-4eb6-899e-8484bd4575d5).
CVSS VectorVendor: a2826606-91e7-4eb6-899e-8484bd4575d5
DescriptionCVE.org
A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run.
This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Rax50 Firmware
View allNETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface pa
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname p
NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface pa
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname p
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname p
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname p
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. Rated critical severity (CVSS
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. Rated critical severity (CVSS
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. Rated critical severity (CVSS
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. Rated critical severity (CVSS
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. Rated critical severity (CVSS
GitHub PoC
Exploit-DB