CVE-2025-12940: Credentials recorded in logs in NETGEAR WAX610 and WAX610Y

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-11 · updated 2026-10-18
Weakness: CWE-532

Description

Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points). An user having access to the syslog server can read the logs containing these credentials. This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4. Devices managed with Insight get automatic updates. If not, please check the firmware version and update to the latest. Fixed in: WAX610 firmware 11.8.0.10 or later. WAX610Y firmware 11.8.0.10 or later.

Affected products

NETGEAR Wax610 Firmware: before 11.8.0.10 — fixed in 11.8.0.10
NETGEAR Wax610Y Firmware: before 11.8.0.10 — fixed in 11.8.0.10

How to fix

Upgrade to a fixed version: NETGEAR Wax610 Firmware 11.8.0.10; NETGEAR Wax610Y Firmware 11.8.0.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-12940 or the next vulnerability affects your stack