CVE-2025-4148 is a high severity buffer overflow (CVSS 8.8) in Netgear EX6200 1.0.3.94. The host argument of the sub_503FC function is handled unsafely. The vendor did not respond to the researcher, so I could not confirm a fix. Limit access to the device and watch the Netgear support page.
What's affected
The CVE record names Netgear EX6200 1.0.3.94. The function involved is sub_503FC, and the argument is host. The public write-up referenced in the record files this one under the name gui_region.
This entry belongs to a run of similar reports against the same firmware published in April and May 2025, from CVE-2025-4140 to CVE-2025-4150. Each one points at a different function of the same firmware, so a fix has to cover all of them, not just one.
The record says the vendor was contacted early about the disclosure but did not respond in any way. I found no Netgear advisory or fixed firmware in the references, so check the Netgear support page for your exact model before you assume a patch exists.
How to check if you're exposed
Log in to the device web interface and find the firmware version page. Compare what it shows with the version in the record. If it matches, or is older, treat the device as affected.
Then look at how the device is reachable. The CVSS vector says the flaw is reachable over the network, with low attack complexity, low privileges and no user interaction. On a home or small office device, the first thing to check is whether remote administration is switched on, and whether the admin page answers from outside your network.
If you cannot tell which devices of this model you own, check your router and extender list, or scan your own address space from inside for the admin interface. Firmware that is not updated by the vendor stays vulnerable for the life of the device.
A note on tooling: the free in-browser dependency scan at https://gold.safeguard.sh/scan reads software manifests, so it will not inspect device firmware. For devices, an inventory and a network check are the right tools.
What to do now
- Find every Netgear EX6200 on your network and record its firmware version.
- Check the Netgear support page for your model for firmware newer than the one in the record, and install it if it exists.
- Turn off remote administration, and limit the admin interface to a trusted wired host or a management VLAN.
- Do not expose the device admin page to the internet through port forwarding.
- If the vendor has stopped issuing firmware for the model, plan to replace it with a supported one.
Why it matters
The record lists CWE-119 and CWE-120. A buffer overflow happens when code copies input into a fixed size block of memory without checking the length first. The extra data spills into neighboring memory and can overwrite values the program relies on. On a small device with few memory protections, that can crash the service, or in the worst case let an attacker run code.
The attack can start remotely, according to the record. The vector also says it needs low privileges to reach the flaw. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not describe exploitation in the wild.
A vendor that does not respond leaves owners with only network controls. That is a reasonable cost to plan for when you buy edge equipment: check how long the maker supports a model, and who to call when a flaw appears.
Quick check
Is there a fix for CVE-2025-4148?
I could not confirm one. The record says the vendor did not respond to the disclosure, so check the Netgear support page for your model.
Is CVE-2025-4148 exploited in the wild?
The record does not say so and it is not on the CISA Known Exploited Vulnerabilities list. Public details can still be reused, so reduce exposure anyway.
Sources
Last reviewed: 18 October 2026.
