PT-2025-5621 · NetGear · Netgear Xr1000+2

Kisimre

·

Published

2025-02-01

·

Updated

2025-03-09

·

CVE-2025-25246

CVSS v3.1

8.1

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions NETGEAR XR1000 versions 1.0.0.0 through 1.0.0.73 NETGEAR XR1000v2 versions 1.0.0.0 through 1.1.0.21 NETGEAR XR500 versions 2.3.2.0 through 2.3.2.133
Description The issue allows remote code execution by unauthenticated users, potentially enabling an attacker to take complete control of the affected device without needing any login credentials. Over 4,000 devices are estimated to be affected.
Recommendations NETGEAR XR1000 versions 1.0.0.0 through 1.0.0.73: Update to version 1.0.0.74 or later. NETGEAR XR1000v2 versions 1.0.0.0 through 1.1.0.21: Update to version 1.1.0.22 or later. NETGEAR XR500 versions 2.3.2.0 through 2.3.2.133: Update to version 2.3.2.134 or later.

Fix

RCE

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-05181
CVE-2025-25246

Affected Products

Netgear Xr1000
Netgear Xr1000V2
Netgear Xr500