Improper input validation in NETGEAR Nighthawk routers

Summary

A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.

Timeline

1. Dec 9, 2025, 5:02 PM UTCCVE published
2. Dec 10, 2025, 4:57 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 26, 2026, 4:57 PM UTCRecord last updated

Affected versions

• NETGEAR RS700

  through 1.0.7.82

• NETGEAR RAX54Sv2

  fixed in V1.1.6.36

• NETGEAR RAX41v2

  fixed in V1.1.6.36

• NETGEAR RAX50

  fixed in V1.2.14.114

• NETGEAR RAXE500

  fixed in V1.2.14.114

• NETGEAR RAX41

  fixed in V1.0.17.142

• NETGEAR RAX43

  fixed in V1.0.17.142

• NETGEAR RAX35v2

  fixed in V1.0.17.142

• NETGEAR RAXE450

  fixed in V1.2.14.114

• NETGEAR RAX43v2

  fixed in V1.1.6.36

• NETGEAR RAX42

  fixed in V1.0.17.142

• NETGEAR RAX45

  fixed in V1.0.17.142

• NETGEAR RAX50v2

  fixed in V1.1.6.36

• NETGEAR MR90

  fixed in V1.0.2.46

• NETGEAR RAX42v2

  fixed in V1.1.6.36

• NETGEAR RAX49S

  fixed in V1.1.6.36

• NETGEAR MS90

  fixed in V1.0.2.46

References 18