Read the docs
TI-2025-11859 Aliases CVE-2025-12943GHSA-gvh9-7g44-g9mq

Improper certificate validation in firmware update logic in NETGEAR RAX30 and RAXE300

Priority LOW 25CWE-295Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) allows attackers with the ability to intercept and tamper traffic destined to the device to execute arbitrary commands on the device. Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update to the latest. Fixed in: RAX30 firmware 1.0.14.108 or later. RAXE300 firmware 1.0.9.82 or later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 6th percentileScored 2026-11-07
Fix Fixed RAX30 (NETGEAR): 1.0.10.95RAXE300 (NETGEAR): 1.0.9.82

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARRAX30before 1.0.10.951.0.10.95Patch availableCNA
NETGEARRAXE300before 1.0.9.821.0.9.82Patch availableCNA
  • RAX30 VendorNETGEAR Affected before 1.0.10.95 Fixed in 1.0.10.95 Patch available CNA
  • RAXE300 VendorNETGEAR Affected before 1.0.9.82 Fixed in 1.0.9.82 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*before 1.0.14.108VulnerableNETGEAR
cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*before 1.0.9.82VulnerableNETGEAR
cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:* Versions before 1.0.14.108 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:* Versions before 1.0.9.82 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

  • Fix · CNA RAX30 (NETGEAR) Fixed in 1.0.10.95
  • Fix · CNA RAXE300 (NETGEAR) Fixed in 1.0.9.82

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12943
  2. 2026-10-03 Alias added: GHSA-gvh9-7g44-g9mq

References

Patch 2

Advisory 1

  • TI-2023-26560 Stack-based buffer overflow in NETGEAR RAX30 CVSS 3.1HIGH 8.8
  • TI-2022-23402 Improper authentication in NETGEAR Nighthawk WiFi6 Router CVSS 3.1HIGH 8.8
  • TI-2023-12452 Buffer overflow in NETGEAR Nighthawk WiFi6 Router CVSS 3.1CRITICAL 9.8
  • TI-2025-28644 In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not… CVSS 3.1CRITICAL 9.8
  • TI-2023-12451 Buffer overflow in NETGEAR Nighthawk WiFi6 Router CVSS 3.1CRITICAL 9.8
  • TI-2023-01254 Improper authentication in Netgear RAX30 CVSS 3.1CRITICAL 9.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences