CVE-2025-45492

Deeper analysis

Netgear EX8000 firmware version 1.0.0.126 is affected by a command-injection flaw (CWE-77) in the action_wireless function, where the Iface parameter is passed to the system shell without adequate sanitization. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no authentication or user interaction required and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply a malicious Iface value in an HTTP request to the device, resulting in arbitrary command execution on the router. Successful exploitation grants the attacker the ability to run operating-system commands, modify configuration, or pivot within the local network.

Public references consist of a technical report and demonstration video published on GitHub that illustrate the injection vector; no vendor advisory or firmware patch information is included in the available data. The EPSS score remains flat at 0.0614 with no upward trajectory after disclosure.