CVE Feed

    Dashboard / CVE / CVE-2025-5495

    CVE-2025-5495

    A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This issue appears to have been circulating as an 0day since 2024.

    Published:Jun 3, 2025
    Last Modified:Aug 11, 2025
    EPS:Jun 3, 2025
    EPSS Score:0.00934
    CVSS Score:7.3

    Affected Products

    Vendor
    Netgear
    Product
    Wnr614
    Vendor
    Netgear
    Product
    Wnr614 Firmware

    Exploits

    https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.mdhttps://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.md

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2024-36788 (CVSS 4.8) — Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows…
    CVE-2024-36790 (CVSS 8.8) — Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.…
    CVE-2024-36789 (CVSS 8.1) — An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not con…
    CVE-2024-36787 (CVSS 8.8) — An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access…
    CVE-2024-36792 (CVSS 8.2) — An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to…
    CVE-2024-36795 (CVSS 4) — Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to access URLs and dire…
    CVE-2016-11057 (CVSS 7.5) — Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-…
    CVE-2017-18791 (CVSS 8.8) — Certain NETGEAR devices are affected by CSRF. This affects R6050/JR6150 before 1.0.1.7, PR2000 before 1.0.0.17…
    CVE-2019-20690 (CVSS 8.8) — Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.30, D7000 befo…
    CVE-2016-10174 (CVSS 9.8) — The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High