Remote Code Execution Vulnerability in NETGEAR WiFi Routers
CVE-2025-25246

8.1HIGH

Key Information:

Vendor

Netgear
Status
Xr1000
Xr1000v2
Xr500
Vendor
CVE Published:
5 February 2025

What is CVE-2025-25246?

Certain models of NETGEAR WiFi routers, including the XR1000 and XR500, are susceptible to a remote code execution vulnerability. This issue permits unauthenticated users to execute arbitrary code on the devices, potentially compromising the security of the entire network. Users of affected models are advised to update their firmware promptly to mitigate this risk and protect their systems from unauthorized access.

Affected Version(s)

XR1000 0 < 1.0.0.74

XR1000v2 0 < 1.1.0.22

XR500 0 < 2.3.2.134

References

https://kb.netgear.com/000066558/Security-Advisory-for-Un...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-25246 : Remote Code Execution Vulnerability in NETGEAR WiFi Routers