VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 9, 2025· Updated Feb 26, 2026

Improper input validation in NETGEAR Nighthawk routers

CVE-2025-12946

Description

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run.

This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

Affected products

18
  • Netgear/RS700llm-create
    Range: <=1.0.7.82
  • NETGEAR/MR90v5
    Range: 0
  • NETGEAR/MS90v5
    Range: 0
  • NETGEAR/RAX35v2v5
    Range: 0
  • NETGEAR/RAX41v5
    Range: 0
  • NETGEAR/RAX41v2v5
    Range: 0
  • NETGEAR/RAX42v5
    Range: 0
  • NETGEAR/RAX42v2v5
    Range: 0
  • NETGEAR/RAX43v5
    Range: 0
  • NETGEAR/RAX43v2v5
    Range: 0
  • NETGEAR/RAX45v5
    Range: 0
  • NETGEAR/RAX49Sv5
    Range: 0
  • NETGEAR/RAX50v5
    Range: 0
  • NETGEAR/RAX50v2v5
    Range: 0
  • NETGEAR/RAX54Sv2v5
    Range: 0
  • NETGEAR/RAXE450v5
    Range: 0
  • NETGEAR/RAXE500v5
    Range: 0
  • NETGEAR/RS700v5
    Range: 0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

18

News mentions

0

No linked articles in our index yet.