CVE-2025-44658

critical · 9.8

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.

9.8

CVSS

1.0%

EPSS (exploit prob.)

62nd

EPSS percentile

2025-07-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
netgear	rax30_firmware	1.0.10.94
netgear	rax30	all versions

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/TPCchecker/c72eea7a3f89070dab7dfdbf7504b2d6
https://www.netgear.com/about/security/
https://www.notion.so/CVE-2025-44658-24754a1113e780df8f72c779a108f75b

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-44658