CVE-2025-4146: Netgear EX6200 Buffer Overflow Vulnerability

CVE-2025-4146 Overview

CVE-2025-4146 is a buffer overflow vulnerability affecting Netgear EX6200 firmware version 1.0.3.94. The flaw resides in the sub_41940 function, where improper handling of the host argument allows attackers to corrupt memory. The vulnerability is associated with [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and [CWE-120] (Buffer Copy without Checking Size of Input).

Attackers can exploit this issue remotely over the network with low privileges and no user interaction. Netgear was contacted regarding the disclosure but did not respond, leaving the firmware unpatched at the time of publication.

Critical Impact
Remote attackers with low privileges can trigger a buffer overflow in the Netgear EX6200 range extender, potentially leading to arbitrary code execution or device compromise.

Affected Products

Netgear EX6200 hardware device
Netgear EX6200 Firmware version 1.0.3.94
Function sub_41940 handling the SMB host name parameter

Discovery Timeline

2025-05-01 - CVE-2025-4146 published to NVD
2025-05-12 - Last updated in NVD database

Technical Details for CVE-2025-4146

Vulnerability Analysis

The vulnerability exists in the sub_41940 function within the Netgear EX6200 firmware. The function processes the host argument, reportedly tied to the SMB host name configuration, without enforcing proper bounds on the input length. Supplying an overly long value overflows the destination buffer and corrupts adjacent memory.

The EX6200 is a WiFi range extender, and exploitation requires network access to the device's management interface. According to the CVSS 4.0 vector, the attacker needs low privileges but no user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the affected device.

The EPSS score of 1.243% places this issue in the 79th percentile for predicted exploitation activity, indicating elevated interest relative to most CVEs. Because the vendor has not responded to the disclosure, no official patch is available.

Root Cause

The root cause is a classic unchecked buffer copy. The sub_41940 function copies the attacker-supplied host value into a fixed-size stack or heap buffer without validating the source length against the destination capacity. This permits overwriting return addresses, function pointers, or adjacent structures on embedded ARM/MIPS firmware where exploit mitigations are typically limited.

Attack Vector

An authenticated attacker on the same network as the EX6200 can send a crafted request containing an oversized host parameter to the affected handler. The request reaches sub_41940, which copies the value into an undersized buffer. The resulting memory corruption can crash the device or, with carefully crafted payloads, achieve arbitrary code execution in the context of the firmware process.

Technical details and proof-of-concept information are available in the public PoC repository and the VulDB entry #306678.

Detection Methods for CVE-2025-4146

Indicators of Compromise

Unexpected reboots or crashes of the Netgear EX6200 device
HTTP or SMB management requests containing abnormally long host parameter values
Unauthorized configuration changes or new administrative sessions on the extender
Outbound connections from the EX6200 to unknown external hosts

Detection Strategies

Inspect management traffic to the EX6200 for oversized string fields targeting host name parameters
Baseline normal request sizes to the device's web and SMB interfaces and alert on outliers
Monitor device logs and syslog output for repeated service crashes or watchdog restarts

Monitoring Recommendations

Capture network traffic between clients and the EX6200 management interface for forensic review
Forward router and switch logs adjacent to the device to a centralized log platform for correlation
Track firmware version and configuration drift across all Netgear range extenders in the environment

How to Mitigate CVE-2025-4146

Immediate Actions Required

Restrict management access to the EX6200 to a trusted administrative VLAN or specific source addresses
Disable SMB and remote management features on the EX6200 if not required for operations
Rotate administrative credentials on the device and any accounts that share passwords with it
Consider replacing the EX6200 with a currently supported model if the vendor remains unresponsive

Patch Information

At the time of disclosure, Netgear had not responded to the researcher and no official patch for firmware version 1.0.3.94 is available. Monitor the Netgear official website for future firmware releases addressing CVE-2025-4146.

Workarounds

Segment the EX6200 onto an isolated network segment that blocks untrusted clients from reaching its management ports
Place the device behind a firewall that filters oversized HTTP and SMB payloads
Disable the SMB host name configuration feature where possible to reduce reachable attack surface

bash

# Example firewall rule restricting EX6200 management to a single admin host
iptables -A FORWARD -s 192.0.2.10 -d 192.168.1.250 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.250 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.250 -p tcp --dport 445 -j DROP