Wnr614 Firmware CVE-2025-5495

This vulnerability presents elevated real-world risk despite the moderate CVSS 7.3 score. Key risk signals: (1) Attack Vector: Network with no privileges required and no user interaction—ideal for automated exploitation; (2) Exploitation Status: Public POC available and circulating as active 0day since 2024, indicating real-world weaponization; (3) Technical Impact: Confidentiality (L), Integrity (L), Availability (L)—achievable data exfiltration and configuration tampering without network disruption; (4) Automatable: Yes—null-byte injection is trivial to automate at scale; (5) CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates minimal friction for attackers. The moderate CVSS may undervalue risk because authentication bypass on network-accessible admin interfaces poses significant real-world threat to millions of deployed WNR614 devices in SMB/consumer networks. SSVC decision: Exploitation=Active, Automatable=Yes, Technical Impact=Moderate → High priority for patching despite CVSS 7.3. Absence of EPSS and KEV status data limits precision, but public POC and documented 0day circulation elevate practical exploitation probability significantly.

An attacker identifies a Netgear WNR614 router on the public internet via port 80/443 scanning or Shodan query. The attacker sends a crafted HTTP GET request: GET /admin/%00currentsetting.htm HTTP/1.1. Due to null-byte handling in the URL parser, the authentication check (typically enforced by /admin/ path rules) is bypassed, and the request is processed as %00currentsetting.htm or simply currentsetting.htm, returning XML or plaintext configuration data containing WiFi credentials (SSID, WPA2-PSK), WAN settings, DHCP configuration, and DNS. The attacker parses the response, extracts WiFi password, and gains network access. Alternatively, if the endpoint accepts POST requests, the attacker could modify settings (e.g., change WAN gateway to attacker-controlled IP, DNS poisoning, or disable security features). Exploitation is fully automated; public POC tools exist. No user interaction required. Timeline: <1 second to compromise per device. Risk multiplier: WNR614 is deployed in thousands of SMB/branch offices globally, making this a high-value mass-exploitation target.