# CVE-2025-12945: NETGEAR Nighthawk R7000P command injection in configuration

Source: https://junglewise.ai/threats/cve-2025-12945-netgear-nighthawk-r7000p-command-injection-in-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-12945 · Severity: low · CVSS 2.4 · Published 2025-12-09

The NETGEAR Nighthawk R7000P is a wireless router used to provide network connectivity in homes and small offices. An authenticated administrator with access to the device's management interface can exploit improper input validation to execute arbitrary operating system commands, potentially compromising the router's integrity and allowing unauthorized modifications to its configuration and functionality. Since the R7000P has reached end-of-service, no security updates are available.

Technologies: [NETGEAR R7000P](https://junglewise.ai/threats/technologies/r7000p). Vendors: [NETGEAR](https://junglewise.ai/threats/vendors/netgear).

## Quick answers

**Is CVE-2025-12945 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12945 being exploited in the wild.

**How severe is CVE-2025-12945?** Low severity, with a CVSS score of 2.4, published 9 December 2025.

**Which products and versions are affected?** NETGEAR Nighthawk R7000P through 1.3.3.154.

**Is there a fix for CVE-2025-12945?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-12945 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-12945?** Check whether you run NETGEAR Nighthawk R7000P, NETGEAR R7000P or NETGEAR R7000p Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw caused by improper input validation in the NETGEAR Nighthawk R7000P router firmware. The attack requires an authenticated administrator with local network access to the device's management interface. An attacker with these privileges can inject shell commands through an unvalidated input field, leading to arbitrary command execution with router privileges. This allows modification of router configuration, software, and functionality. The vulnerability affects R7000P firmware versions through 1.3.3.154; no patches are available as the product has reached end-of-support status.

## Affected products

- NETGEAR Nighthawk R7000P through 1.3.3.154

## Timeline

- 2025-12-09: disclosed
- other: Product has reached end-of-support; no security updates planned

## References

- [https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory](https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory)
- [https://www.netgear.com/support/product/r7000p](https://www.netgear.com/support/product/r7000p)

## Related threats

- [NETGEAR routers insufficient input validation in NTP setting](https://junglewise.ai/threats/cve-2026-9218-insufficient-input-validation-vulnerability-in-time-server-ntp)