CVE-2025-12946
📋 TL;DR
This vulnerability in NETGEAR Nighthawk routers allows attackers on the WAN side to execute commands by manipulating DNS responses during speedtests. It affects multiple router models when running vulnerable firmware versions. Attackers can exploit this using man-in-the-middle techniques.
💻 Affected Systems
- RS700
- RAX54Sv2
- RAX41v2
- RAX50
- RAXE500
- RAX41
- RAX43
- RAX35v2
- RAXE450
- RAX43v2
- RAX42
- RAX45
- RAX50v2
- MR90
- MS90
- RAX42v2
- RAX49S
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on the router, allowing attackers to take full control, intercept traffic, modify configurations, or pivot to internal networks.
Likely Case
Attackers execute limited commands to disrupt router functionality, modify DNS settings, or deploy malware on the router.
If Mitigated
With proper network segmentation and monitoring, impact is limited to router compromise without lateral movement to internal systems.
🎯 Exploit Status
Requires man-in-the-middle position on WAN side and user to run speedtest. No authentication needed for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by model - see NETGEAR advisory for specific fixed versions
Vendor Advisory: https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Check for updates. 4. Download and install latest firmware. 5. Reboot router after update.
🔧 Temporary Workarounds
Disable Speedtest Feature
allTemporarily disable the speedtest functionality to prevent exploitation.
Use VPN for Speedtests
allRoute speedtest traffic through a VPN to prevent DNS manipulation.
🧯 If You Can't Patch
- Segment router from internal network using VLANs or separate physical network
- Monitor for unusual DNS traffic or speedtest activity from WAN side
🔍 How to Verify
Check if Vulnerable:
Check router firmware version against affected versions in NETGEAR advisory.Check Version:
Log into router admin interface and check firmware version in settings.Verify Fix Applied:
Verify firmware version matches or exceeds fixed version listed in advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual speedtest activity
- DNS response manipulation attempts
- Unexpected command execution in router logs
Network Indicators:
- DNS traffic anomalies during speedtests
- Unusual outbound connections from router
SIEM Query:
Search for speedtest-related events followed by command execution or DNS anomalies.🔗 References
- https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory
- https://www.netgear.com/support/product/RAX50
- https://www.netgear.com/support/product/mr90
- https://www.netgear.com/support/product/ms90
- https://www.netgear.com/support/product/rax35v2
- https://www.netgear.com/support/product/rax41
- https://www.netgear.com/support/product/rax41v2
- https://www.netgear.com/support/product/rax42
- https://www.netgear.com/support/product/rax42v2
- https://www.netgear.com/support/product/rax43
- https://www.netgear.com/support/product/rax43v2
- https://www.netgear.com/support/product/rax45
- https://www.netgear.com/support/product/rax49s
- https://www.netgear.com/support/product/rax50v2
- https://www.netgear.com/support/product/rax54sv2
- https://www.netgear.com/support/product/raxe450
- https://www.netgear.com/support/product/raxe500
- https://www.netgear.com/support/product/rs700
