Denial of Service Vulnerability in Netgear Routers and Extenders
CVE-2025-44650

7.5HIGH

Key Information:

Vendor

Netgear
Status
Netgear R7000 and EAX80
Vendor
CVE Published:
21 July 2025

What is CVE-2025-44650?

In specific versions of the Netgear R7000 and EAX80, a misconfiguration in the bftpd.conf file leads to a vulnerability where the USERLIMIT_GLOBAL option is set to 0. This allows for unlimited user connections, making the system susceptible to Denial of Service attacks. When numerous users connect simultaneously, server resources can be overwhelmed, resulting in rendered services inaccessible. It's crucial for users to review their configurations and apply necessary updates to mitigate potential risks.

References

https://www.netgear.com/about/security/
https://gist.github.com/TPCchecker/d13d15dfa8965ba88a9437...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.