CVE-2025-45492

Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function

Medium · published May 6, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
71.2
In the wild
Unconfirmed
What it is

⚠️ Watch out! The Netgear EX8000 has a sneaky command injection vulnerability waiting to be exploited via the Iface parameter! 🔥 Think of this as a restaurant where anyone can slip a note to the chef without the waiter checking it first. If the chef blindly prepares whatever is written, you might end up with a dish that could ruin the entire meal! 🍽️ An attacker could execute arbitrary commands on the device, potentially compromising your network and leading to unauthorized access. While it’s not actively being exploited, the risk is real enough that it warrants your attention!

Put simply

Think of this as a restaurant where anyone can slip a note to the chef without the waiter checking it first. If the chef blindly prepares whatever is written, you might end up with a dish that could ruin the entire meal! 🍽️ This vulnerability allows attackers to inject commands through the Iface parameter in the action_wireless function, leading to unauthorized command execution on the Netgear EX8000 router.

What to do

An attacker could execute arbitrary commands on the device, potentially compromising your network and leading to unauthorized access. While it’s not actively being exploited, the risk is real enough that it warrants your attention! To remediate this vulnerability, update your Netgear EX8000 firmware to version V1.0.0.127 or later. Additionally, ensure you're monitoring for any unexpected behavior in your network settings. You've got this! By patching and staying vigilant, you can keep your network safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01345 · 71.2th percentile
Published
2025-05-06T00:00Z
EPSS history
Timeline
  • 06 MAY 00:00Z
    Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function
    cvelistv5