CVE-2025-4146 is a high severity buffer overflow (CVSS 8.8) in Netgear EX6200 1.0.3.94. The host argument of the sub_41940 function is handled unsafely. The vendor did not respond to the researcher, so I could not confirm a fix. Limit access to the device and watch the Netgear support page.
What's affected
The CVE record names Netgear EX6200 1.0.3.94. The function involved is sub_41940, and the argument is host. The public write-up referenced in the record files this one under the name smb_host_name.
This entry belongs to a run of similar reports against the same firmware published in April and May 2025, from CVE-2025-4140 to CVE-2025-4150. Each one points at a different function of the same firmware, so a fix has to cover all of them, not just one.
The record says the vendor was contacted early about the disclosure but did not respond in any way. I found no Netgear advisory or fixed firmware in the references, so check the Netgear support page for your exact model before you assume a patch exists.
How to check if you're exposed
Open the administration page of the device and read the firmware version. The record names one exact version, so a match is a clear sign you are in scope, and an older one is a safe bet too.
Then look at how the device is reachable. The CVSS vector says the flaw is reachable over the network, with low attack complexity, low privileges and no user interaction. On a home or small office device, the first thing to check is whether remote administration is switched on, and whether the admin page answers from outside your network.
If you cannot tell which devices of this model you own, check your router and extender list, or scan your own address space from inside for the admin interface. Firmware that is not updated by the vendor stays vulnerable for the life of the device.
A note on tooling: the free in-browser dependency scan at https://gold.safeguard.sh/scan reads software manifests, so it will not inspect device firmware. For devices, an inventory and a network check are the right tools.
What to do now
- Find every Netgear EX6200 on your network and record its firmware version.
- Check the Netgear support page for your model for firmware newer than the one in the record, and install it if it exists.
- Turn off remote administration, and limit the admin interface to a trusted wired host or a management VLAN.
- Do not expose the device admin page to the internet through port forwarding.
- If the vendor has stopped issuing firmware for the model, plan to replace it with a supported one.
Why it matters
The record lists CWE-119 and CWE-120. Memory safety bugs like this one are common in router and extender firmware, which is mostly written in C and rarely rebuilt. A function that copies a request value into a fixed buffer, with no length check, is the classic shape. The result is anything from a crashed web interface to full control of the device.
The attack can start remotely, according to the record. The vector also says it needs low privileges to reach the flaw. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not describe exploitation in the wild.
A vendor that does not respond leaves owners with only network controls. That is a reasonable cost to plan for when you buy edge equipment: check how long the maker supports a model, and who to call when a flaw appears.
Quick check
Is there a fix for CVE-2025-4146?
I could not confirm one. The record says the vendor did not respond to the disclosure, so check the Netgear support page for your model.
Is CVE-2025-4146 exploited in the wild?
The record does not say so and it is not on the CISA Known Exploited Vulnerabilities list. Public details can still be reused, so reduce exposure anyway.
Sources
Last reviewed: 18 October 2026.
