CVE-2025-7407
Published: 10 July 2025
Summary
CVE-2025-7407 is a medium-severity Command Injection (CWE-77) vulnerability in Netgear D6400 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating and sanitizing the host_name argument in the diag.cgi file to block malicious command execution.
Mandates prohibiting or compensating for unsupported system components like the unpatched Netgear D6400 firmware version 1.0.0.114 vulnerable to this issue.
Restricts remote network access to the vulnerable diag.cgi endpoint through boundary protection, mitigating the AV:N exploitation vector.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing router web component (diag.cgi) directly enables remote exploitation of a network device (T1190) and arbitrary command execution via its CLI (T1059.008).
NVD Description
A vulnerability, which was classified as critical, was found in Netgear D6400 1.0.0.114. This affects an unknown part of the file diag.cgi. The manipulation of the argument host_name leads to os command injection. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early and confirmed the existence of the vulnerability. They reacted very quickly, professional and kind. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2025-7407 is a critical vulnerability involving OS command injection in the Netgear D6400 router running firmware version 1.0.0.114. The issue resides in an unspecified component of the diag.cgi file, where manipulation of the host_name argument enables the injection. It is remotely exploitable and classified under CWE-77 and CWE-78, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Attackers with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity and no user interaction required. Successful exploitation allows limited impacts, including low confidentiality, integrity, and availability effects through arbitrary OS command execution on the device.
References, including VulDB entries and a GitHub repository, disclose a proof-of-concept exploit and confirm the vendor was notified early, acknowledged the issue promptly and professionally, but noted that only unsupported products are affected, implying no patches are available from the maintainer. Security practitioners should prioritize isolating or retiring affected D6400 devices, as public exploit details may enable active attacks.
Details
- CWE(s)