A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

Metrics

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Netgear
  • Mr90
  • Ms90
  • Rax35v2
  • Rax41
  • Rax41v2
  • Rax42
  • Rax42v2
  • Rax43
  • Rax43v2
  • Rax45
  • Rax49s
  • Rax50
  • Rax50v2
  • Rax54sv2
  • Raxe450
  • Raxe500
  • Rs700

No data.

No data.

References
Link Providers
https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory cve-icon cve-icon
https://www.netgear.com/support/product/RAX50 cve-icon cve-icon
https://www.netgear.com/support/product/mr90 cve-icon cve-icon
https://www.netgear.com/support/product/ms90 cve-icon cve-icon
https://www.netgear.com/support/product/rax35v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax41 cve-icon cve-icon
https://www.netgear.com/support/product/rax41v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax42 cve-icon cve-icon
https://www.netgear.com/support/product/rax42v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax43 cve-icon cve-icon
https://www.netgear.com/support/product/rax43v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax45 cve-icon cve-icon
https://www.netgear.com/support/product/rax49s cve-icon cve-icon
https://www.netgear.com/support/product/rax50v2 cve-icon cve-icon
https://www.netgear.com/support/product/rax54sv2 cve-icon cve-icon
https://www.netgear.com/support/product/raxe450 cve-icon cve-icon
https://www.netgear.com/support/product/raxe500 cve-icon cve-icon
https://www.netgear.com/support/product/rs700 cve-icon cve-icon
History

Tue, 09 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Dec 2025 19:45:00 +0000

Type Values Removed Values Added
References

Tue, 09 Dec 2025 18:30:00 +0000

Type Values Removed Values Added
References

Tue, 09 Dec 2025 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.
Title Improper input validation in NETGEAR Nighthawk routers
First Time appeared Netgear
Netgear mr90
Netgear ms90
Netgear rax35v2
Netgear rax41
Netgear rax41v2
Netgear rax42
Netgear rax42v2
Netgear rax43
Netgear rax43v2
Netgear rax45
Netgear rax49s
Netgear rax50
Netgear rax50v2
Netgear rax54sv2
Netgear raxe450
Netgear raxe500
Netgear rs700
Weaknesses CWE-20
CPEs cpe:2.3:h:netgear:mr90:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ms90:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax35v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax41:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax41v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax42:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax42v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax43:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax43v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax45:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax49s:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax50:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax50v2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax54sv2:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:raxe450:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:raxe500:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs700:*:*:*:*:*:*:*:*
Vendors & Products Netgear
Netgear mr90
Netgear ms90
Netgear rax35v2
Netgear rax41
Netgear rax41v2
Netgear rax42
Netgear rax42v2
Netgear rax43
Netgear rax43v2
Netgear rax45
Netgear rax49s
Netgear rax50
Netgear rax50v2
Netgear rax54sv2
Netgear raxe450
Netgear raxe500
Netgear rs700
References
Metrics cvssV4_0

{'score': 4.4, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:A/V:D/RE:M/U:Amber'}
cve-icon MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published: 2025-12-09T17:02:20.739Z

Updated: 2025-12-10T04:57:22.798Z

Reserved: 2025-11-10T08:26:32.586Z

Link: CVE-2025-12946

cve-icon Vulnrichment

Updated: 2025-12-09T20:22:16.677Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T17:15:48.820

Modified: 2025-12-09T20:15:53.397

Link: CVE-2025-12946

cve-icon Redhat

No data.