CVE-2025-4149: Critical Buffer Overflow Vulnerability in Netgear EX6200 1.0.3.94

Overview

The CVE-2025-4149 is a critical vulnerability discovered in Netgear EX6200 version 1.0.3.94. The flaw exists in the function sub_54014 and can be exploited remotely by manipulating the argument ‘host’, which leads to a buffer overflow. This is a grave concern for users and administrators of the said product as it opens up the potential for system compromise and data leakage, posing significant threats to privacy and security.
Given the vendor’s lack of response to this disclosure, it is imperative that users are made aware of the vulnerability and its impacts. The severity score of 8.8 assigned to this vulnerability reflects its potential to inflict significant damage, and measures need to be taken to mitigate the risks.

Vulnerability Summary

CVE ID: CVE-2025-4149
Severity: Critical (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage

Affected Products

Product | Affected Versions

Netgear EX6200 | 1.0.3.94

How the Exploit Works

The exploit works by manipulating the ‘host’ argument in the function sub_54014. This manipulation triggers a buffer overflow, which can allow an attacker to execute arbitrary code on the system or even gain control of the system. The attack can be initiated remotely over the network, requiring no user interaction and no special privileges, which makes it particularly dangerous.

Conceptual Example Code

The following is a conceptual example of how an attacker might exploit this vulnerability. This could be done by sending a specially crafted HTTP request to the target device:

POST /sub_54014 HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "host": "A long string that causes buffer overflow..." }

In the above example, the ‘host’ key in the JSON body is given a long string value that exceeds the buffer capacity, triggering an overflow.
Please note that this is a conceptual example and the actual exploitation would require specific knowledge of the system’s architecture and the vulnerable function’s implementation.