CVE-2025-12943
Full vulnerability record from the local CVENow database.
Description
Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) allows attackers with the ability to intercept and tamper traffic destined to the device to execute arbitrary commands on the device. Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update to the latest. Fixed in: RAX30 firmware 1.0.14.108 or later. RAXE300 firmware 1.0.9.82 or later
Severity
MEDIUM
CVSS score
5.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
a2826606-91e7-4eb6-899e-8484bd4575d5
Published
2025-11-11 17:15:39.410000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-12943",
"sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"published": "2025-11-11T17:15:39.410",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper certificate\nvalidation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream\nAX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band\nWiFi 6E Router) allows attackers with the ability to intercept and\ntamper traffic destined to the device to execute arbitrary commands on the\ndevice.\n\nDevices\nwith automatic updates enabled may already have this patch applied. If not,\nplease check the firmware version and update to the\nlatest.\n\n\n\nFixed in:\n\n\n\nRAX30 firmware\n1.0.14.108 or later.\n\n\n\nRAXE300 firmware\n1.0.9.82 or later"
},
{
"lang": "es",
"value": "La validación de certificado incorrecta en la lógica de actualización del firmware en los routers NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) y RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) permite a los atacantes con la capacidad de interceptar y manipular el tráfico destinado al dispositivo ejecutar comandos arbitrarios en el dispositivo.\n\nLos dispositivos con actualizaciones automáticas habilitadas ya pueden tener este parche aplicado. Si no, por favor, compruebe la versión del firmware y actualice a la última.\n\nCorregido en:\n\nFirmware de RAX30 1.0.14.108 o posterior.\n\nFirmware de RAXE300 1.0.9.82 o posterior."
}
],
"affected": [
{
"source": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"affectedData": [
{
"vendor": "NETGEAR",
"product": "RAX30",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "1.0.10.95",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "NETGEAR",
"product": "RAXE300",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "1.0.9.82",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "LOW",
"providerUrgency": "AMBER"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-13T04:55:33.797632Z",
"id": "CVE-2025-12943",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.14.108",
"matchCriteriaId": "CE447F48-3725-4BF7-A83F-A3C36549F60D"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBC92B49-60E0-4554-BE7F-D2B5D6EF6454"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.9.82",
"matchCriteriaId": "F8B7657D-2C55-4C4C-AC18-DF2B0961C06C"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD3BE955-696E-41D6-B281-1473EC803803"
}
]
}
]
}
],
"references": [
{
"url": "https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025",
"source": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.netgear.com/support/product/rax30",
"source": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"tags": [
"Product"
]
},
{
"url": "https://www.netgear.com/support/product/raxe300",
"source": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"tags": [
"Product"
]
}
]
}