Command Injection Vulnerability in NETGEAR Nighthawk R7000P Routers
CVE-2025-12945

1.1LOW

Key Information:

Vendor

Netgear
Status
R7000p
Vendor
CVE Published:
9 December 2025

What is CVE-2025-12945?

An OS command injection vulnerability exists in NETGEAR Nighthawk R7000P routers due to improper input validation by the authenticated admin interface. This flaw could allow an attacker with administrative access to execute arbitrary OS commands on the device. The vulnerable firmware versions of the router are through 1.3.3.154, posing risks to device integrity and security. It's essential for users to implement mitigations and updates to safeguard their networks from potential exploitation.

Affected Version(s)

R7000P 0 <= 1.3.3.154

References

https://www.netgear.com/support/product/r7000p
product
https://kb.netgear.com/000070416/December-2025-NETGEAR-Se...
vendor-advisory

CVSS V4

Score:
1.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SmallS
JSON
.