{"id":"CVE-2025-4121","state":"PUBLISHED","title":"Netgear JWNR2000v2 cmd_wireless command injection","description":"A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The manipulation of the argument host leads to command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-04-30T14:00:07.565Z","updatedAt":"2025-04-30T15:43:26.903Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Netgear JWNR2000v2"],"affected":[{"vendor":"Netgear","product":"JWNR2000v2","versions":[{"version":"1.0.0.11","status":"affected"}]}],"references":["https://vuldb.com/?id.306601","https://vuldb.com/?ctiid.306601","https://vuldb.com/?submit.560775","https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Command_injection-cmd_wireless-port_phy_set/README.md","https://www.netgear.com/"],"weaknesses":["CWE-77","CWE-74"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4121.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4121","state":"PUBLISHED","datePublished":"2025-04-30T14:00:07.565Z","dateUpdated":"2025-04-30T15:43:26.903Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-04-30T05:12:04.856Z"},"containers":{"cna":{"title":"Netgear JWNR2000v2 cmd_wireless command injection","descriptions":[{"lang":"en","value":"A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The manipulation of the argument host leads to command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"In Netgear JWNR2000v2 1.0.0.11 wurde eine kritische Schwachstelle ausgemacht. Das betrifft die Funktion cmd_wireless. Durch das Beeinflussen des Arguments host mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden."}],"affected":[{"vendor":"Netgear","product":"JWNR2000v2","versions":[{"version":"1.0.0.11","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.306601","name":"VDB-306601 | Netgear JWNR2000v2 cmd_wireless command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.306601","name":"VDB-306601 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.560775","name":"Submit #560775 | Netgear JWNR2000v2 1.0.0.11  Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Command_injection-cmd_wireless-port_phy_set/README.md","tags":["related"]},{"url":"https://www.netgear.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","type":"CWE","lang":"en","description":"Command Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-04-30T14:00:07.565Z"},"timeline":[{"time":"2025-04-30T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-04-30T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-04-30T07:17:22.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"yummysoup2 (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-30T15:43:15.092614Z","id":"CVE-2025-4121","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-30T15:43:26.903Z"}}]}}}