CVE-2025-12946A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniq…
Updated under an hour ago ()
Does this affect you?
It affects netgear rs700_firmware and 17 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-20
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
netgear rs700_firmware netgear:rs700_firmware | before 1.0.9.6 | NVD |
netgear rax54sv2_firmware netgear:rax54sv2_firmware | before 1.1.6.36 | NVD |
netgear rax45v2_firmware netgear:rax45v2_firmware | before 1.1.6.36 | NVD |
netgear rax41v2_firmware netgear:rax41v2_firmware | before 1.1.6.36 | NVD |
netgear rax50_firmware netgear:rax50_firmware | before 1.2.14.114 | NVD |
netgear raxe500_firmware netgear:raxe500_firmware | before 1.2.14.114 | NVD |
netgear rax41_firmware netgear:rax41_firmware | before 1.0.17.142 | NVD |
netgear rax43_firmware netgear:rax43_firmware | before 1.0.17.142 | NVD |
netgear rax35v2_firmware netgear:rax35v2_firmware | before 1.0.17.142 | NVD |
netgear raxe450_firmware netgear:raxe450_firmware | before 1.0.17.142 | NVD |
netgear rax43v2_firmware netgear:rax43v2_firmware | before 1.1.6.36 | NVD |
netgear rax42_firmware netgear:rax42_firmware | before 1.0.17.142 | NVD |
netgear rax45_firmware netgear:rax45_firmware | before 1.0.17.142 | NVD |
netgear rax50v2_firmware netgear:rax50v2_firmware | before 1.1.6.36 | NVD |
netgear mr90_firmware netgear:mr90_firmware | before 1.0.2.46 | NVD |
netgear ms90_firmware netgear:ms90_firmware | before 1.0.2.46 | NVD |
netgear rax42v2_firmware netgear:rax42v2_firmware | before 1.1.6.36 | NVD |
netgear rax49s_firmware netgear:rax49s_firmware | before 1.1.6.36 | NVD |
References
- https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisorypatch, vendor-advisory
- https://www.netgear.com/support/product/RAX50patch, product
- https://www.netgear.com/support/product/mr90patch, product
- https://www.netgear.com/support/product/ms90patch, product
- https://www.netgear.com/support/product/rax35v2patch, product
- https://www.netgear.com/support/product/rax41patch, product
- https://www.netgear.com/support/product/rax41v2patch, product
- https://www.netgear.com/support/product/rax42patch, product
- https://www.netgear.com/support/product/rax42v2patch, product
- https://www.netgear.com/support/product/rax43patch, product
- https://www.netgear.com/support/product/rax43v2patch, product
- https://www.netgear.com/support/product/rax45patch, product
- https://www.netgear.com/support/product/rax49spatch, product
- https://www.netgear.com/support/product/rax50v2patch, product
- https://www.netgear.com/support/product/rax54sv2patch, product
- https://www.netgear.com/support/product/raxe450patch, product
- https://www.netgear.com/support/product/raxe500patch, product
- https://www.netgear.com/support/product/rs700patch, product
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.