PT-2025-5621 · NetGear · Netgear Xr1000+2

Kisimre

·

Publicado

2025-02-01

·

Atualizado

2025-03-09

·

CVE-2025-25246

CVSS v3.1

8.1

Alta

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions NETGEAR XR1000 versions 1.0.0.0 through 1.0.0.73 NETGEAR XR1000v2 versions 1.0.0.0 through 1.1.0.21 NETGEAR XR500 versions 2.3.2.0 through 2.3.2.133
Description The issue allows remote code execution by unauthenticated users, potentially enabling an attacker to take complete control of the affected device without needing any login credentials. Over 4,000 devices are estimated to be affected.
Recommendations NETGEAR XR1000 versions 1.0.0.0 through 1.0.0.73: Update to version 1.0.0.74 or later. NETGEAR XR1000v2 versions 1.0.0.0 through 1.1.0.21: Update to version 1.1.0.22 or later. NETGEAR XR500 versions 2.3.2.0 through 2.3.2.133: Update to version 2.3.2.134 or later.

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2025-05181
CVE-2025-25246

Produtos afetados

Netgear Xr1000
Netgear Xr1000V2
Netgear Xr500