CVE-2025-4116 is a high severity buffer overflow (CVSS 8.8) in Netgear JWNR2000v2 1.0.0.11. The host argument of the get_cur_lang_ver function is handled unsafely. The vendor did not respond to the researcher, so I could not confirm a fix. Limit access to the device and watch the Netgear support page.
What's affected
The CVE record names Netgear JWNR2000v2 1.0.0.11. The function involved is get_cur_lang_ver, and the argument is host. The public write-up referenced in the record files this one under the name StringTable_NonEnglish_Ver.
This entry belongs to a run of similar reports against the same firmware that were published together, from CVE-2025-4114 to CVE-2025-4121. Each one points at a different function of the same firmware, so a fix has to cover all of them, not just one.
The record says the vendor was contacted early about the disclosure but did not respond in any way. I found no Netgear advisory or fixed firmware in the references, so check the Netgear support page for your exact model before you assume a patch exists.
How to check if you're exposed
Read the firmware version from the device web interface or from the label and setup records you kept. The version in the record is the one that was tested, so earlier ones should be assumed to share the flaw.
Then look at how the device is reachable. The CVSS vector says the flaw is reachable over the network, with low attack complexity, low privileges and no user interaction. On a home or small office device, the first thing to check is whether remote administration is switched on, and whether the admin page answers from outside your network.
If you cannot tell which devices of this model you own, check your router and extender list, or scan your own address space from inside for the admin interface. Firmware that is not updated by the vendor stays vulnerable for the life of the device.
A note on tooling: the free in-browser dependency scan at https://gold.safeguard.sh/scan reads software manifests, so it will not inspect device firmware. For devices, an inventory and a network check are the right tools.
What to do now
- Find every Netgear JWNR2000v2 on your network and record its firmware version.
- Check the Netgear support page for your model for firmware newer than the one in the record, and install it if it exists.
- Turn off remote administration, and limit the admin interface to a trusted wired host or a management VLAN.
- Do not expose the device admin page to the internet through port forwarding.
- If the vendor has stopped issuing firmware for the model, plan to replace it with a supported one.
Why it matters
The record lists CWE-119 and CWE-120. The mechanism is old and well understood. Input arrives, the code copies it into a buffer of fixed size, and nothing stops the copy from running past the end. Whatever sits after the buffer gets overwritten. Fixing it means checking lengths before copying, which is a small change that the vendor has to make and ship.
The attack can start remotely, according to the record. The vector also says it needs low privileges to reach the flaw. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not describe exploitation in the wild.
A vendor that does not respond leaves owners with only network controls. That is a reasonable cost to plan for when you buy edge equipment: check how long the maker supports a model, and who to call when a flaw appears.
Quick check
Is there a fix for CVE-2025-4116?
I could not confirm one. The record says the vendor did not respond to the disclosure, so check the Netgear support page for your model.
Is CVE-2025-4116 exploited in the wild?
The record does not say so and it is not on the CISA Known Exploited Vulnerabilities list. Public details can still be reused, so reduce exposure anyway.
Sources
Last reviewed: 18 October 2026.
