A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run.



This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

Metrics

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00097.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: RS700 firmware V1.0.9.6 or later RAX54Sv2/RAX45v2  firmware V1.1.6.36 or later https://www.netgear.com/support/product/rax54sv2 RAX41v2  firmware V1.1.6.36 or later https://www.netgear.com/support/product/rax41v2 RAX50  firmware V1.2.14.114 or later https://www.netgear.com/support/product/RAX50 RAXE500  firmware V1.2.14.114 or later https://www.netgear.com/support/product/raxe500 RAX41 firmware V1.0.17.142 or later https://www.netgear.com/support/product/rax41 RAX43 firmware V1.0.17.142 or later https://www.netgear.com/support/product/rax43 RAX35v2 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX35v2 RAXE450 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAXE450 RAX43v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX43v2 RAX42 firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX42 RAX45  firmware V1.0.17.142 or later https://www.netgear.com/support/product/RAX45 RAX50v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX50v2 MR90 firmware V1.0.2.46 or later https://www.netgear.com/support/product/MR90 MS90 firmware V1.0.2.46 or later https://www.netgear.com/support/product/MS90 RAX42v2 firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX42v2 RAX49S firmware V1.1.6.36 or later https://www.netgear.com/support/product/RAX42v2

Workaround

No workaround given by the vendor.

References
Link Providers
https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory cve-icon cve-icon
https://www.netgear.com/support/product/RAX50 cve-icon cve-icon
https://www.netgear.com/support/product/mr90 cve-icon cve-icon
https://www.netgear.com/support/product/ms90 cve-icon cve-icon
https://www.netgear.com/support/product/rax35v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax41 cve-icon cve-icon
https://www.netgear.com/support/product/rax41v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax42 cve-icon cve-icon
https://www.netgear.com/support/product/rax42v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax43 cve-icon cve-icon
https://www.netgear.com/support/product/rax43v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax45 cve-icon cve-icon
https://www.netgear.com/support/product/rax49s cve-icon cve-icon
https://www.netgear.com/support/product/rax50v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax54sv2 cve-icon cve-icon
https://www.netgear.com/support/product/raxe450 cve-icon cve-icon
https://www.netgear.com/support/product/raxe500 cve-icon cve-icon
https://www.netgear.com/support/product/rs700 cve-icon cve-icon
History

Tue, 09 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Dec 2025 19:45:00 +0000

Type Values Removed Values Added
References

Tue, 09 Dec 2025 18:30:00 +0000

Type Values Removed Values Added
References

Tue, 09 Dec 2025 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.
Title Improper input validation in NETGEAR Nighthawk routers
First Time appeared Netgear
Netgear mr90
Netgear ms90
Netgear rax35v2
Netgear rax41
Netgear rax41v2
Netgear rax42
Netgear rax42v2
Netgear rax43
Netgear rax43v2
Netgear rax45
Netgear rax49s
Netgear rax50
Netgear rax50v2
Netgear rax54sv2
Netgear raxe450
Netgear raxe500
Netgear rs700
Weaknesses CWE-20
CPEs cpe:2.3:h:netgear:mr90:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ms90:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax35v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax41:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax41v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax42:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax42v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax43:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax43v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax45:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax49s:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax50:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax50v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax54sv2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:raxe450:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:raxe500:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs700:*:*:*:*:*:*:*:*
Vendors & Products Netgear
Netgear mr90
Netgear ms90
Netgear rax35v2
Netgear rax41
Netgear rax41v2
Netgear rax42
Netgear rax42v2
Netgear rax43
Netgear rax43v2
Netgear rax45
Netgear rax49s
Netgear rax50
Netgear rax50v2
Netgear rax54sv2
Netgear raxe450
Netgear raxe500
Netgear rs700
References
Metrics cvssV4_0

{'score': 4.4, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:A/V:D/RE:M/U:Amber'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published:

Updated: 2025-12-10T04:57:22.798Z

Reserved: 2025-11-10T08:26:32.586Z

Link: CVE-2025-12946

cve-icon Vulnrichment

Updated: 2025-12-09T20:22:16.677Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T17:15:48.820

Modified: 2025-12-09T20:15:53.397

Link: CVE-2025-12946

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses