CVE-2025-4135

Netgear WG302v2 ui_get_input_value command injection

State: Published
Severity: 5.3 Medium
Published: Apr 30, 2025
Updated: Apr 30, 2025
Reserved: Apr 30, 2025

Description

A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulation of the argument host leads to command injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
WG302v2Netgear	5.2.0Affected 5.2.1Affected 5.2.2Affected 5.2.3Affected 5.2.4Affected 5.2.5Affected 5.2.6Affected 5.2.7Affected 5.2.8Affected 5.2.9Affected

References

VDB-306626 | Netgear WG302v2 ui_get_input_value command injectionvdb-entrytechnical-description
VDB-306626 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #560779 | Netgear WG302v2 5.2.9 Command Injectionthird-party-advisory
https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_WG302v2/Command_injection-basic_settings_handler-static-ip-update/README.mdpatch
https://www.netgear.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.