Netgear EX8000 CVE-2025-45493

Requires network reachability to the EX8000's HTTP(S) management interface and the ability to invoke the action_bandwidth handler with a malicious iface parameter containing shell metacharacters; only firmware V1.0.0.126 is identified as affected. The published vector claims no privileges (PR:N), but these Netgear extender CGI endpoints normally require an authenticated admin session, which - if true - is the primary limiting factor and would confine exploitation to attackers who have already authenticated or who reach an exposed/default-credential device on the local network rather than the open Internet. Authentication requirement is not confirmed from the available data.

Signals are mixed and point to a moderate, not urgent, priority. CVSS 3.1 is 6.5 (medium) with the published vector AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:N - note this vector is internally questionable: a classic command-injection flaw (CWE-77) in a router's action_bandwidth handler normally yields full command execution (C:H/I:H), so the partial C:L/I:L/A:N impact and especially PR:N are suspect, since these Netgear extender CGI endpoints typically sit behind the admin web session - verify authentication requirement with the vendor. EPSS is low at 0.90% (59th percentile), indicating no broad automated exploitation is expected. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (a PDF write-up and an mp4 demonstration on GitHub) but it is not verified as working, weaponized exploit code. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency issue: a reproducible injection in a consumer mesh extender with demonstration material, but low exploitation probability and no in-the-wild evidence. Net: treat as a scheduled-patch item, prioritized above routine but below KEV/emergency work.

An attacker with reachability to the EX8000's web management interface sends a crafted request to the action_bandwidth function with shell metacharacters injected into the iface parameter, causing the device to execute attacker-supplied OS commands. A public PoC reference (PDF and video demonstration) exists showing the injection, though it is not verified as a packaged working exploit. Given the AV:N/AC:L vector, exploitation is low-complexity once the attacker can reach the management endpoint.