CVE-2025-44658

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Unrestricted Upload of File with Dangerous Type pada netgear rax30 firmware. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.

Rincian

Terbit di NVD

21 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.netgear.com/about/security/ advisory vendor
• https://www.notion.so/CVE-2025-44658-24754a1113e780df8f72c779a108f75b advisory pihak ketiga
• https://gist.github.com/TPCchecker/c72eea7a3f89070dab7dfdbf7504b2d6 broken link