CVE-2025-12945 - Improper input validation in NETGEAR Nighthawk router R7000P

Back Back to CVE browser

LOW

Improper input validation in NETGEAR Nighthawk router R7000P

Published Dec 9, 2025

1.1

LOW

CVSS 4.0

EPSS 1.14%

Description

An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability.

This issue affects R7000P: through 1.3.3.154.

Affected products

Vendor NETGEAR Product n/a Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.3.3.154

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NETGEAR

n/a

unaffected

Version	Status	Constraints
0	affected	<=1.3.3.154

Remediation

Vendor solution

NETGEAR R7000P has reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire this device and upgrade to a newer NETGEAR device for continued security support.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202284
Advisory
https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory
vendor-advisoryVendor Advisory
https://www.netgear.com/support/product/r7000p
productPatch

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202284		Advisory
https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory		vendor-advisoryVendor Advisory
https://www.netgear.com/support/product/r7000p		productPatch