CVE-2025-12943 Improper certificate validation in firmware update logic in NETGEAR RAX30 and RAXE300
Attackers intercepting traffic can bypass certificate validation to execute arbitrary commands on NETGEAR RAX30 and RAXE300 routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12943?
CVE-2025-12943 is a medium-severity vulnerability in NETGEAR RAX30, published on 11 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) allows attackers with the ability to intercept and tamper traffic destined to the device to execute arbitrary commands on the device.
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update to the latest.
Fixed in:
RAX30 firmware 1.0.14.108 or later.
RAXE300 firmware 1.0.9.82 or later
Weakness: CWE-295
Which versions are affected by CVE-2025-12943?
It affects 2 products.
Products include Netgear Rax30 Firmware, Netgear Raxe300 Firmware.
How do I fix CVE-2025-12943?
No fix has been published for CVE-2025-12943 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12943 being exploited?
There is no known exploitation of CVE-2025-12943 in the wild and no public exploit code.
Other vulnerabilities in NETGEAR RAX30
- CVE-2025-44658 File upload in n/a
- CVE-2023-1327 Auth bypass in Netgear RAX30 (AX2400)
- CVE-2023-27852 Memory corruption in NETGEAR Nighthawk WiFi6 Router
- CVE-2023-27853 Other in NETGEAR Nighthawk WiFi6 Router
- CVE-2023-51635 NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability
Sources
Also known as GHSA-gvh9-7g44-g9mq.