CVE-2025-12945

Improper input validation in NETGEAR Nighthawk router R7000P

State: Published
Severity: 1.1 Low
Published: Dec 9, 2025
Updated: Aug 26, 2026
Reserved: Nov 10, 2025

Description

An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability.

This issue affects R7000P: through 1.3.3.154.

Scores

CVSS	Score	Vector	Source
4.0	1.1 Low	CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber	NETGEAR
3.1	2.4 Low	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N	NETGEAR

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
R7000PNETGEAR	1.3.3.154 and earlierAffected

References

https://www.netgear.com/support/product/r7000pproduct
https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisoryvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.