# CVE-2025-12943: Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6…

Source: https://junglewise.ai/threats/cve-2025-12943-improper-certificate-validation-in-firmware-update-logic-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-11  
License: CC BY 4.0 with a link back

CVE-2025-12943 · Severity: high · CVSS 7.5 · Published 2025-11-11

Improper certificate
validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream
AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band
WiFi 6E Router) allows attackers with the ability to intercept and
tamper traffic destined to the device to execute arbitrary commands on the
device.

Devices
with automatic updates enabled may already have this patch applied. If not,
please check the firmware version and update to the
latest.



Fixed in:



RAX30 firmware
1.0.14.108 or later.



RAXE300 firmware
1.0.9.82 or later

Technologies: [NETGEAR RAX30](https://junglewise.ai/threats/technologies/rax30), [NETGEAR Rax30 Firmware](https://junglewise.ai/threats/technologies/rax30-firmware), [NETGEAR RAXE300](https://junglewise.ai/threats/technologies/raxe300). Vendors: [NETGEAR](https://junglewise.ai/threats/vendors/netgear).

## Quick answers

**Is CVE-2025-12943 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12943 being exploited in the wild.

**How severe is CVE-2025-12943?** High severity, with a CVSS score of 7.5, published 11 November 2025.

**Which products and versions are affected?** NETGEAR RAX30, NETGEAR Rax30 Firmware, NETGEAR RAXE300, NETGEAR Raxe300 Firmware. The advisory does not name versions.

**Is there a fix for CVE-2025-12943?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-12943?** Check whether you run NETGEAR RAX30, NETGEAR Rax30 Firmware, NETGEAR RAXE300 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- NETGEAR RAX30
- NETGEAR Rax30 Firmware
- NETGEAR RAXE300
- NETGEAR Raxe300 Firmware

## Related threats

- [NETGEAR RAX/CAX router insufficient input validation in Block Sites](https://junglewise.ai/threats/cve-2026-11732-an-insufficient-input-validation-vulnerability-in-the-website)
- [NETGEAR RAX series authentication bypass in management service](https://junglewise.ai/threats/cve-2026-11731-an-authentication-bypass-vulnerability-in-the-listed-netgear-rax)
- [NETGEAR RAX series insufficient input validation in management UI](https://junglewise.ai/threats/cve-2026-9216-netgear-rax-series-insufficient-input-validation-in-management-ui)
- [NETGEAR Nighthawk and Orbi routers command injection vulnerability](https://junglewise.ai/threats/cve-2026-11814-netgear-nighthawk-and-orbi-routers-command-injection)
- [Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected…](https://junglewise.ai/threats/cve-2026-11738-insufficient-input-validation-vulnerability-in-the-listed-netgear)