CVE-2025-12943: Netgear RAX30 Firmware RCE Vulnerability

CVE-2025-12943 Overview

CVE-2025-12943 is an improper certificate validation flaw [CWE-295] in the firmware update logic of NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) devices. An attacker positioned to intercept and tamper with traffic destined for the device can deliver a malicious firmware payload and execute arbitrary commands on the router. The flaw was disclosed in the NETGEAR Security Advisory November 2025. Fixed builds are RAX30 firmware 1.0.14.108 or later and RAXE300 firmware 1.0.9.82 or later.

Critical Impact
An adjacent-network attacker performing a man-in-the-middle attack on firmware update traffic can execute arbitrary commands on affected NETGEAR routers, gaining full control of the network edge device.

Affected Products

NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) firmware prior to 1.0.14.108
NETGEAR RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) firmware prior to 1.0.9.82
NETGEAR RAX30 and RAXE300 hardware platforms

Discovery Timeline

2025-11-11 - CVE-2025-12943 published to NVD
2025-12-08 - Last updated in NVD database

Technical Details for CVE-2025-12943

Vulnerability Analysis

The vulnerability resides in the firmware update routine used by the affected NETGEAR Nighthawk routers. The update client fails to properly validate the TLS certificate presented by the firmware distribution endpoint. As a result, the device accepts firmware images served from a server that does not present a trusted, correctly chained certificate matching the expected hostname.

Because the update channel is the trust anchor for new code running on the router, weakening certificate validation directly undermines the integrity of every subsequent firmware install. An attacker who can substitute the update server response can deliver a crafted firmware bundle. The router will install it and execute arbitrary commands packaged within. Exploitation requires adjacent-network positioning, such as control of an upstream link, a compromised ISP path, or a hostile Wi-Fi segment between the router and the update endpoint.

Root Cause

The root cause is improper certificate validation [CWE-295] in the firmware update client. Acceptable validation requires verifying the full certificate chain against trusted roots, confirming the certificate has not expired or been revoked, and matching the Subject Alternative Name to the expected NETGEAR update hostname. One or more of these checks is missing or incorrectly implemented in vulnerable firmware versions.

Attack Vector

The attack vector is adjacent network. An attacker must be able to intercept and modify traffic flowing from the router to NETGEAR's firmware distribution infrastructure. Typical positioning includes ARP spoofing on the WAN-side broadcast domain, BGP or DNS hijacking targeting the update endpoint, or operation of a rogue upstream device. Once positioned, the attacker presents a substitute TLS endpoint and serves a malicious firmware image. Because the device does not reject the invalid certificate, the malicious image is downloaded and applied, leading to command execution under the privileges of the firmware update process.

No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-12943

Indicators of Compromise

Unexpected firmware version strings on RAX30 or RAXE300 devices that do not match official NETGEAR release notes.
Outbound connections from router management interfaces to non-NETGEAR hosts during update windows.
TLS sessions from the router to update endpoints presenting certificates not signed by NETGEAR's expected certificate authority chain.
Unexplained reboots or configuration changes coinciding with firmware update activity.

Detection Strategies

Monitor DNS resolutions for NETGEAR update domains and alert on responses pointing to unexpected IP ranges.
Inspect outbound TLS handshakes from router IPs and flag sessions where the server certificate is self-signed or issued by an unexpected CA.
Compare installed firmware hashes against the official versions published by NETGEAR for RAX30 and RAXE300.
Correlate firmware update events with network anomalies such as ARP table changes or upstream routing changes.

Monitoring Recommendations

Log and retain network metadata for all management traffic originating from edge routers in a centralized analytics platform.
Alert on any new outbound destinations for devices that should only contact a small set of vendor endpoints.
Track firmware version inventory across all NETGEAR Nighthawk devices in the environment and review weekly.

How to Mitigate CVE-2025-12943

Immediate Actions Required

Verify the firmware version on every RAX30 and RAXE300 device and upgrade to RAX30 1.0.14.108 or later, and RAXE300 1.0.9.82 or later.
Enable automatic firmware updates so the patched build is applied without manual intervention.
Restrict who can connect to the same broadcast domain as the router's WAN interface to reduce adjacent-network exposure.
Audit recent firmware update events on affected devices for signs of tampering before patching.

Patch Information

NETGEAR has released fixed firmware addressing CVE-2025-12943. Apply RAX30 firmware 1.0.14.108 or later, or RAXE300 firmware 1.0.9.82 or later. Devices with automatic updates enabled may have already received the patch. Download instructions and release notes are available on the NETGEAR RAX30 Support Page and the NETGEAR RAXE300 Support Page. Full advisory details are published in the NETGEAR Security Advisories - November 2025.

Workarounds

Avoid triggering manual firmware checks until the device is on a trusted network segment with no untrusted adjacent hosts.
Place affected routers behind a separately managed gateway that performs egress filtering until patched.
Disable remote management features that could expose update workflows to untrusted Wi-Fi or LAN segments.

bash

# Verify firmware version via the NETGEAR admin UI or check release notes
# Patched versions:
#   RAX30:   1.0.14.108 or later
#   RAXE300: 1.0.9.82 or later