CVE-2025-5495 is a high severity authentication flaw in the URL handler of the Netgear WNR614 router, firmware 1.1.0.28_1.0.1WW. A crafted request using a null byte prefix on the settings page path avoids authentication. The record says it circulated as a zero day since 2024, and names no fix.
What's affected
- Product: Netgear WNR614 router and its firmware.
- Affected: firmware 1.1.0.28_1.0.1WW, per the record.
- Component: the URL handler, where the input starting with a null byte followed by
currentsetting.htmleads to improper authentication. - Fixed firmware: none is named. The record lists Netgear's home page as its only vendor reference, which is not an advisory.
The record states the issue appears to have been circulating as a zero day since 2024 and that exploit information is public. It is not on the CISA KEV list, so there is no official confirmation of active attacks here.
How to check if you're exposed
Find the firmware version in the router's admin page, usually on the status or firmware screen. Compare it with 1.1.0.28_1.0.1WW.
Also check these:
- Whether remote management of the router is enabled. If it is, the admin pages are open to the internet, and you should turn it off.
- Which devices in your fleet are WNR614 units. Small offices and remote workers often have older consumer routers that nobody tracks.
- Whether Netgear still publishes firmware for the model. Check the vendor's support page for the model number.
Routers are not library packages, so a dependency scan will not see them. They belong in a network device inventory.
What to do now
- Identify every WNR614 you own or that connects to your network.
- Check Netgear's support page for new firmware for this model and install it if one exists.
- Disable remote administration, and only allow the admin interface from the local network.
- Change the admin password and review settings such as DNS servers and port forwarding for changes you did not make.
- If no firmware update exists, plan to replace the device with a supported model.
Why it matters
The weakness is improper authentication. The URL handler treated a specially formed path as something other than the protected page, so the check that normally demands a login did not apply. Path and URL parsing differences between the layer that decides who may view a page and the layer that serves it are a familiar source of bypasses.
Routers deserve attention because they control all traffic for a site. An attacker who reaches the admin pages can change DNS settings or open ports. The score is high rather than critical because the vector shows only limited impact on each of confidentiality, integrity and availability, but the practical risk depends on whether the admin interface is reachable from outside.
The weakness is classed as CWE-287 (Improper Authentication). Severity in the CVE record: high, CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Quick check
Is there a firmware fix?
The record names none. Check Netgear's support page for the model, and replace the router if there is nothing current.
What is the quickest mitigation?
Turn off remote administration so the admin pages are only reachable from the local network, and use a strong admin password.
Sources
- Researcher write-up on GitHub (listed in the CVE record, not fetched)
- VulDB entry 310911 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
