CVE-2025-25246
High
Description
NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users.
SeverityHigh
CVSS8.1
Exploit probability—
Product
XR1000
PublishedFeb 5, 2025
First seenFeb 5, 2025
Weakness typeCWE-94Code injection
How to fix
Update
- NETGEAR XR10001.0.0.74 or later
- NETGEAR XR1000v21.1.0.22 or later
- NETGEAR XR5002.3.2.134 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| NETGEAR XR1000 | v < 1.0.0.74 | 1.0.0.74 |
| NETGEAR XR1000v2 | v < 1.1.0.22 | 1.1.0.22 |
| NETGEAR XR500 | v < 2.3.2.134 | 2.3.2.134 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.