Cyber Posture

CVE-2025-25246

High

Published: 05 February 2025

Published
05 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0498 89.7th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2025-25246 is a remote code execution vulnerability (CWE-94) in NETGEAR WiFi routers. It affects XR1000 versions before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134, enabling unauthenticated attackers to execute arbitrary code on these devices.

The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network with no privileges or user interaction required, though it demands high attack complexity. Remote unauthenticated users who can reach the device can achieve high impacts on confidentiality, integrity, and availability, potentially fully compromising the router.

NETGEAR's security advisory (PSV-2023-0039) at https://kb.netgear.com/000066558/Security-Advisory-for-Unauthenticated-RCE-on-Some-WiFi-Routers-PSV-2023-0039 details mitigation steps for this unauthenticated RCE issue on affected WiFi routers.

Details

CWE(s)
CWE-94

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Unauthenticated RCE on public-facing WiFi routers directly enables T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary code execution on the Linux-based device.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References