EUVD-2025-17624Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents HIGH real-world risk despite being in an unsupported product. CVSS 8.8 with AV:N (network-accessible), AC:L (low complexity), and PR:L (low privilege requirement) indicates a readily exploitable flaw. The three critical impact factors (C:H, I:H, A:H) mean full system compromise is possible. The public availability of exploit code significantly elevates real-world risk. However, the PR:L requirement (authenticated user needed) provides a moderate control that limits opportunistic mass exploitation compared to unauthenticated vulnerabilities. Without KEV/EPSS data explicitly provided, the disclosed POC status and critical CVSS score suggest this should be treated as actively exploitable. For end-of-life products still in use (common in residential/SOHO networks), this represents a significant risk tier—likely SSVC 'Scheduled' or 'Out-of-Cycle' depending on organizational criticality. |
| Exploit ScenarioDerived | An authenticated attacker (e.g., someone with WiFi access credentials or local network access) crafts a malicious request to the /mtd endpoint or related firmware interface that triggers the buffer overflow in sub_41619C. By carefully controlling input length and content, the attacker overwrites stack memory containing a return address. Upon function return, execution redirects to attacker-controlled shellcode, granting remote code execution (RCE) with device privileges. The attacker can then modify firmware, exfiltrate network traffic, pivot to other network devices, or disable the extender. The low attack complexity and disclosed POC code make this exploitable by moderately-skilled attackers. Attack could be fully automated against subnets containing unpatched EX3700 devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
A critical stack-based buffer overflow vulnerability (CVE-2025-5934) exists in Netgear EX3700 wireless extenders up to version 1.0.0.88, affecting the sub_41619C function in the /mtd file. An authenticated attacker can remotely exploit this vulnerability to achieve complete system compromise including confidentiality, integrity, and availability breaches. Public exploit code is available, and while the affected product line is no longer supported by Netgear, immediate patching to version 1.0.0.98 is critical for active deployments.
RemediationAI
Immediate remediation: Upgrade Netgear EX3700 firmware to version 1.0.0.98 or later. Steps: (1) Access extender management interface (typically 192.168.0.1 or mywifi.net); (2) Navigate to Administration/Firmware Update; (3) Download firmware 1.0.0.98+ from Netgear support site (https://www.netgear.com/support/); (4) Apply update and verify version post-restart. For organizations unable to upgrade: isolate affected devices on separate VLANs, restrict administrative access via firewall rules, and consider replacement with supported hardware. No known workarounds exist for stack-based overflow vulnerabilities—patching is mandatory. Given end-of-life status, verify firmware availability through Netgear legacy support channels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the Netgear EX3700 firmware's /mtd partition handling, specifically in the sub_41619C function. The EX3700 is a WiFi range extender running proprietary Netgear firmware. Stack-based overflows allow attackers to overwrite return addresses and stack variables, enabling arbitrary code execution. The /mtd designation suggests this affects the MTD (Memory Technology Device) layer or firmware region, likely involved in device configuration or upgrade mechanisms. The CWE-119 classification indicates unsafe buffer operations without proper bounds checking on stack-allocated buffers.
Know when Ex3700 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Netgear EX3700 up to 1.0.0.88. It has been classified as critical. Affected is the function sub_41619C of the file /mtd. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.0.98 is able to address this issue. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
A critical remote code execution vulnerability (CVE-2025-5934) affects Netgear EX3700 wireless extenders running firmware versions up to 1.0.0.88. Organizations deploying these devices face immediate risk of unauthorized network access and data compromise, as public exploits are available and no vendor patch currently exists. This vulnerability impacts end-of-life products with no active support.
Network segmentation: isolate EX3700 devices to guest/non-critical networks only. Disable remote management features on affected devices. Implement network-based IDS/IPS rules to detect exploitation patterns targeting /mtd stack overflow. Monitor device logs for suspicious access attempts. Consider air-gapping vulnerable units until replacement. Enable MAC filtering on affected devices. Note: Firmware upgrade to version 1.0.0.98 is the primary mitigation; verify availability through Netgear support or authorized channels.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Ex3700 Firmware
View allNetgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injectio
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. Rated critical severity (CVSS
Certain NETGEAR devices are affected by weak cryptography. Rated critical severity (CVSS 9.8), this vulnerability is rem
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. Rated critical severity (CVSS
Certain NETGEAR devices are affected by incorrect configuration of security settings. Rated critical severity (CVSS 9.4)
Certain NETGEAR devices are affected by incorrect configuration of security settings. Rated high severity (CVSS 8.8), th
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R640
Certain NETGEAR devices are affected by CSRF. Rated high severity (CVSS 8.0), this vulnerability is no authentication re
Certain NETGEAR devices are affected by incorrect configuration of security settings. Rated high severity (CVSS 7.2), th
Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in
Certain NETGEAR devices are affected by command injection by an authenticated user. Rated medium severity (CVSS 6.8), th
Certain NETGEAR devices are affected by reflected XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely
Exploit-DB