CVE-2025-45492

An attacker sends a crafted network request containing a malicious payload in the Iface parameter handled by the action_wireless function. Input data is not properly validated or sanitized before being passed to the system interpreter, which allows injection and execution of arbitrary commands at the operating system level of the device. The attack does not require authentication or user interaction, and the vulnerability is remotely accessible over the network.

An attacker can gain full control over the device — read confidential configuration data, modify network settings, and potentially use the device as an entry point for further lateral movement in the network.

Apply patches available from the manufacturer according to references. Until firmware is updated, it is recommended to restrict access to the device management interface only to trusted hosts and isolate the device in the network.

Netgear EX8000 with firmware version V1.0.0.126