CVE-2025-12943

Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) allows attackers with the ability to intercept and tamper traffic destined to the device to execute arbitrary commands on the device. Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update to the latest. Fixed in: RAX30 firmware 1.0.14.108 or later. RAXE300 firmware 1.0.9.82 or later

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025	Vendor Advisory
https://www.netgear.com/support/product/rax30	Product
https://www.netgear.com/support/product/raxe300	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La validación de certificado incorrecta en la lógica de actualización del firmware en los routers NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) y RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) permite a los atacantes con la capacidad de interceptar y manipular el tráfico destinado al dispositivo ejecutar comandos arbitrarios en el dispositivo. Los dispositivos con actualizaciones automáticas habilitadas ya pueden tener este parche aplicado. Si no, por favor, compruebe la versión del firmware y actualice a la última. Corregido en: Firmware de RAX30 1.0.14.108 o posterior. Firmware de RAXE300 1.0.9.82 o posterior.

Information

Published : 2025-11-11 17:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-12943

Mitre link : CVE-2025-12943

CVE.ORG link : CVE-2025-12943

JSON object : View

Products Affected

netgear

raxe300
rax30_firmware
raxe300_firmware
rax30

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2025-12943", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12943", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T04:55:33.797632Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.2, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "affectedData": [{"vendor": "NETGEAR", "product": "RAX30", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.10.95", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAXE300", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.9.82", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-11T17:15:39.410", "references": [{"url": "https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025", "tags": ["Vendor Advisory"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/rax30", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/raxe300", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Improper certificate\nvalidation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream\nAX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band\nWiFi 6E Router) allows attackers with the ability to intercept and\ntamper traffic destined to the device to execute arbitrary commands on the\ndevice.\n\nDevices\nwith automatic updates enabled may already have this patch applied. If not,\nplease check the firmware version and update to the\nlatest.\n\n\n\nFixed in:\n\n\n\nRAX30 firmware\n1.0.14.108 or later.\n\n\n\nRAXE300 firmware\n1.0.9.82 or later"}, {"lang": "es", "value": "La validaci\u00f3n de certificado incorrecta en la l\u00f3gica de actualizaci\u00f3n del firmware en los routers NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) y RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) permite a los atacantes con la capacidad de interceptar y manipular el tr\u00e1fico destinado al dispositivo ejecutar comandos arbitrarios en el dispositivo.\n\nLos dispositivos con actualizaciones autom\u00e1ticas habilitadas ya pueden tener este parche aplicado. Si no, por favor, compruebe la versi\u00f3n del firmware y actualice a la \u00faltima.\n\nCorregido en:\n\nFirmware de RAX30 1.0.14.108 o posterior.\n\nFirmware de RAXE300 1.0.9.82 o posterior."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE447F48-3725-4BF7-A83F-A3C36549F60D", "versionEndExcluding": "1.0.14.108"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EBC92B49-60E0-4554-BE7F-D2B5D6EF6454"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8B7657D-2C55-4C4C-AC18-DF2B0961C06C", "versionEndExcluding": "1.0.9.82"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BD3BE955-696E-41D6-B281-1473EC803803"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5"}