CVE-2025-12943

published 2025-11-11

CVE-2025-12943: Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band…

Priority P3 46 high 7.5 CVSS 3.1

AV A AC H PR N UI N S U C H I H A H

Improper certificate
validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream
AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band
WiFi 6E Router) allows attackers with the ability to intercept and
tamper traffic destined to the device to execute arbitrary commands on the
device.

Devices
with automatic updates enabled may already have this patch applied. If not,
please check the firmware version and update to the
latest.

Fixed in:

RAX30 firmware
1.0.14.108 or later.

RAXE300 firmware
1.0.9.82 or later

Affected

4 ranges

Vendor	Product	Version range	Fixed in
netgear	rax30	< 1.0.10.95	1.0.10.95
netgear	rax30_firmware	< 1.0.14.108	1.0.14.108
netgear	raxe300	< 1.0.9.82	1.0.9.82
netgear	raxe300_firmware	< 1.0.9.82	1.0.9.82

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 5.2 MEDIUM CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-295