Read the docs
TI-2025-11856 Aliases CVE-2025-12940GHSA-43cp-h386-xgfv

Credentials recorded in logs in NETGEAR WAX610 and WAX610Y

Priority LOW 5CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points). An user having access to the syslog server can read the logs containing these credentials.  This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4. Devices managed with Insight get automatic updates. If not, please check the firmware version and update to the latest. Fixed in: WAX610 firmware 11.8.0.10 or later. WAX610Y firmware 11.8.0.10 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed WAX610 (NETGEAR): 10.8.11.4WAX610Y (NETGEAR): 10.8.11.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARWAX610before 10.8.11.410.8.11.4Patch availableCNA
NETGEARWAX610Ybefore 10.8.11.410.8.11.4Patch availableCNA
  • WAX610 VendorNETGEAR Affected before 10.8.11.4 Fixed in 10.8.11.4 Patch available CNA
  • WAX610Y VendorNETGEAR Affected before 10.8.11.4 Fixed in 10.8.11.4 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:netgear:wax610y_firmware:*:*:*:*:*:*:*:*before 11.8.0.10VulnerableNETGEAR
cpe:2.3:h:netgear:wax610y:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:wax610_firmware:*:*:*:*:*:*:*:*before 11.8.0.10VulnerableNETGEAR
cpe:2.3:h:netgear:wax610:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:wax610y_firmware:*:*:*:*:*:*:*:* Versions before 11.8.0.10 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:wax610y:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:wax610_firmware:*:*:*:*:*:*:*:* Versions before 11.8.0.10 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:wax610:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

  • Fix · CNA WAX610 (NETGEAR) Fixed in 10.8.11.4
  • Fix · CNA WAX610Y (NETGEAR) Fixed in 10.8.11.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12940
  2. 2026-10-03 Alias added: GHSA-43cp-h386-xgfv

References

Patch 2

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences