CVE-2025-12942

Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R6260: through 1.1.0.86; R6850: through 1.1.0.86.

CVSS 4.0

4.8CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber

CVSS 3.1

7.5CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-25)

CWE

CWE-20

Published

2025-11-11

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• netgear:r6260_firmware
• netgear:r6850_firmware

References

• https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025
• https://www.netgear.com/support/product/r6260
• https://www.netgear.com/support/product/r6850

Check your stackJSON