CVE-2025-12940 Credentials recorded in logs in NETGEAR WAX610 and WAX610Y
Attackers with syslog access can read login credentials from logs on NETGEAR WAX610 access points when syslog is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12940?
CVE-2025-12940 is a low-severity vulnerability in NETGEAR WAX610, published on 11 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points). An user having access to the syslog server can read the logs containing these credentials.
This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.
Devices managed with Insight get automatic updates. If not, please check the firmware version and update to the latest.
Fixed in:
WAX610 firmware 11.8.0.10 or later.
WAX610Y firmware 11.8.0.10 or later.
Weakness: CWE-532
Which versions are affected by CVE-2025-12940?
It affects 2 products.
Products include Netgear Wax610 Firmware, Netgear Wax610y Firmware.
How do I fix CVE-2025-12940?
No fix has been published for CVE-2025-12940 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12940 being exploited?
There is no known exploitation of CVE-2025-12940 in the wild and no public exploit code.
Sources
Also known as GHSA-43cp-h386-xgfv.