Description
An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability.





This issue affects R7000P: through 1.3.3.154.
Published: 2025-12-09
Score: 1.1 Low
EPSS: 1.8% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

NETGEAR R7000P has reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire this device and upgrade to a newer NETGEAR device for continued security support.

Vendor Workaround

NETGEAR strongly recommends not to allow untrusted users to administer your device and protect it with strong password.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability in NETGEAR Nighthawk R7000P routers lets an authenticated admin execute OS command injections due to improper input validation. This issue affects R7000P: through 1.3.3.154. An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability. This issue affects R7000P: through 1.3.3.154.
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'}

Fri, 16 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Netgear r7000p Firmware
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r7000p_firmware:*:*:*:*:*:*:*:*
Vendors & Products Netgear r7000p Firmware
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Tue, 09 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Dec 2025 19:45:00 +0000

Type Values Removed Values Added
References

Tue, 09 Dec 2025 18:30:00 +0000

Type Values Removed Values Added
References

Tue, 09 Dec 2025 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in NETGEAR Nighthawk R7000P routers lets an authenticated admin execute OS command injections due to improper input validation. This issue affects R7000P: through 1.3.3.154.
Title Improper input validation in NETGEAR Nighthawk router R7000P
First Time appeared Netgear
Netgear r7000p
Weaknesses CWE-20
CPEs cpe:2.3:h:netgear:r7000p:*:*:*:*:*:*:*:*
Vendors & Products Netgear
Netgear r7000p
References
Metrics cvssV4_0

{'score': 1.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber'}

Subscriptions

Netgear R7000p R7000p Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published:

Updated: 2026-08-26T16:17:50.127Z

Reserved: 2025-11-10T08:26:25.516Z

Link: CVE-2025-12945

cve-icon Vulnrichment

Updated: 2025-12-09T20:22:24.868Z

cve-icon NVD

Status : Modified

Published: 2025-12-09T17:15:48.647

Modified: 2026-08-26T17:16:46.000

Link: CVE-2025-12945

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses