CVE-2025-12942

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

mproper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R6260: through 1.1.0.86; R6850: through 1.1.0.86.

References

Link	Resource
https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025	Vendor Advisory
https://www.netgear.com/support/product/r6260	Product
https://www.netgear.com/support/product/r6850	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r6260:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*

History

08 Dec 2025, 14:26

Type	Values Removed	Values Added
CPE		cpe:2.3:o:netgear:r6850_firmware:::::::: cpe:2.3:h:netgear:r6850:-:::::::* cpe:2.3:o:netgear:r6260_firmware:::::::: cpe:2.3:h:netgear:r6260:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Netgear Netgear r6850 Firmware Netgear r6850 Netgear r6260 Firmware Netgear r6260
References	~~() https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025 -~~	() https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025 - Vendor Advisory
References	~~() https://www.netgear.com/support/product/r6260 -~~	() https://www.netgear.com/support/product/r6260 - Product
References	~~() https://www.netgear.com/support/product/r6850 -~~	() https://www.netgear.com/support/product/r6850 - Product

11 Nov 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-11-11 17:15

Updated : 2025-12-08 14:26

NVD link : CVE-2025-12942

Mitre link : CVE-2025-12942

CVE.ORG link : CVE-2025-12942

JSON object : View

Products Affected

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-12942", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 4.8, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-11-11T17:15:39.263", "references": [{"url": "https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025", "tags": ["Vendor Advisory"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/r6260", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/r6850", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R6260: through 1.1.0.86; R6850: through 1.1.0.86."}], "lastModified": "2025-12-08T14:26:54.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BCB2B8D-97C7-4375-A22D-433CDA54B15B", "versionEndExcluding": "1.1.0.86"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r6260:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3C395D49-57F9-4BC1-8619-57127355B86B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21FCB108-13E2-4E10-B96B-9DDEDE94BAA8", "versionEndExcluding": "1.1.0.86"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "598B48C5-4706-4431-8C5A-DA496DD1052F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5"}