Sign-up

ID

VAR-202504-3413


CVE

CVE-2025-4139


TITLE

of netgear  EX6120  Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007395

DESCRIPTION

A vulnerability classified as critical was found in Netgear EX6120 1.0.0.68. Affected by this vulnerability is the function fwAcosCgiInbound. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. of netgear EX6120 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NETGEAR EX6120 is a wireless extender from NETGEAR. The vulnerability is caused by the failure of the parameter host of the fwAcosCgiInbound function to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2025-4139 // JVNDB: JVNDB-2025-007395 // CNVD: CNVD-2025-09916

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-09916

AFFECTED PRODUCTS

vendor:netgearmodel:ex6120scope:eqversion:1.0.0.68

Trust: 1.6

vendor:ネットギアmodel:ex6120scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:ex6120scope:eqversion: -

Trust: 0.8

vendor:ネットギアmodel:ex6120scope:eqversion:ex6120 firmware 1.0.0.68

Trust: 0.8

sources: CNVD: CNVD-2025-09916 // JVNDB: JVNDB-2025-007395 // NVD: CVE-2025-4139

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-4139
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-007395
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-09916
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-4139
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-007395
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-09916
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-4139
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-007395
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-09916 // JVNDB: JVNDB-2025-007395 // NVD: CVE-2025-4139

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-120

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-007395 // NVD: CVE-2025-4139

EXTERNAL IDS

db:NVDid:CVE-2025-4139

Trust: 3.2

db:VULDBid:306631

Trust: 1.8

db:JVNDBid:JVNDB-2025-007395

Trust: 0.8

db:CNVDid:CNVD-2025-09916

Trust: 0.6

sources: CNVD: CNVD-2025-09916 // JVNDB: JVNDB-2025-007395 // NVD: CVE-2025-4139

REFERENCES

url:https://vuldb.com/?id.306631

Trust: 1.8

url:https://vuldb.com/?submit.560785

Trust: 1.8

url:https://www.netgear.com/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-4139

Trust: 1.4

url:https://vuldb.com/?ctiid.306631

Trust: 1.0

url:https://github.com/jylsec/vuldb/blob/main/netgear/netgear_ex6120/buffer_overflow-fwacoscgiinbound-port_end/readme.md

Trust: 1.0

sources: CNVD: CNVD-2025-09916 // JVNDB: JVNDB-2025-007395 // NVD: CVE-2025-4139

SOURCES

db:CNVDid:CNVD-2025-09916
db:JVNDBid:JVNDB-2025-007395
db:NVDid:CVE-2025-4139

LAST UPDATE DATE

2025-06-29T23:22:35.388000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-09916date:2025-05-16T00:00:00
db:JVNDBid:JVNDB-2025-007395date:2025-06-24T02:32:00
db:NVDid:CVE-2025-4139date:2025-06-23T15:13:27.283

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-09916date:2025-05-16T00:00:00
db:JVNDBid:JVNDB-2025-007395date:2025-06-24T00:00:00
db:NVDid:CVE-2025-4139date:2025-04-30T21:15:55.003