Rax45V2 Firmware
Monthly
Command execution and information disclosure in the built-in speedtest feature of multiple NETGEAR Nighthawk routers (RAX/RAXE/MR/MS/RS700 families) allows an attacker positioned on the router's WAN side to conduct an active attacker-in-the-middle attack, spoof DNS responses, and have malicious commands executed when the router's speedtest is run. Exploitation is not autonomous: it requires a privileged upstream network position plus the victim actively triggering a speedtest, which is why the assessed severity is only 4.4/MEDIUM despite high confidentiality, integrity, and availability impact on the device. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); EPSS is very low at 0.29% (20th percentile), consistent with a targeted rather than opportunistic threat. Vendor-released fixed firmware is available for the affected models.
Command execution and information disclosure in the built-in speedtest feature of multiple NETGEAR Nighthawk routers (RAX/RAXE/MR/MS/RS700 families) allows an attacker positioned on the router's WAN side to conduct an active attacker-in-the-middle attack, spoof DNS responses, and have malicious commands executed when the router's speedtest is run. Exploitation is not autonomous: it requires a privileged upstream network position plus the victim actively triggering a speedtest, which is why the assessed severity is only 4.4/MEDIUM despite high confidentiality, integrity, and availability impact on the device. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); EPSS is very low at 0.29% (20th percentile), consistent with a targeted rather than opportunistic threat. Vendor-released fixed firmware is available for the affected models.