CVE-2025-4141

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. This affects the function sub_3C03C. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Netgear	EX6200	1.0.3.94

References

https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_3C03C-bpa_server/README.mdExploit
https://vuldb.com/?ctiid.306633Permissions Required, VDB Entry
https://vuldb.com/?id.306633Third Party Advisory, VDB Entry
https://vuldb.com/?submit.560789Third Party Advisory, VDB Entry
https://www.netgear.com/Product

Timeline

Published: Apr 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-414105.4Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process w CVE-2025-414137.8Fuji Electric Smart Editor is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.CVE-2025-414147.5When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Softwa CVE-2025-414156.5The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensiti CVE-2025-414185.3Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. The CGI process may be terminated a CVE-2025-41429.8A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. This vulnerability affects the function sub_3C8EC. The CVE-2025-414209.6A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master comm CVE-2025-414214.7Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and CVE-2025-414234.3Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugin CVE-2025-414258.1DuraComm SPM-500 DP-10iN-100-MU is vulnerable to a cross-site scripting attack. This could allow an attacker to prevent legitimate users f CVE-2025-414269.8Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code exec CVE-2025-414278.7WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Inject