What’s Vulnerable › Vulnerabilities

CVE-2025-44658

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-21 · updated 2026-06-17
• Weakness: CWE-434

Description

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.

Affected products

• NETGEAR RAX30: 1.0.10.94

References

• https://gist.github.com/TPCchecker/c72eea7a3f89070dab7dfdbf7504b2d6
• https://www.netgear.com/about/security/
• https://www.notion.so/CVE-2025-44658-24754a1113e780df8f72c779a108f75b

Get alerted when CVE-2025-44658 or the next vulnerability affects your stack