CVE-2025-44658

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/TPCchecker/c72eea7a3f89070dab7dfdbf7504b2d6Broken Link
https://www.netgear.com/about/security/Vendor Advisory
https://www.notion.so/CVE-2025-44658-24754a1113e780df8f72c779a108f75bThird Party Advisory

Timeline

Published: Jul 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-44669.8A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the CVE-2025-44679.8A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been declared as critical. This vulnerability affect CVE-2025-44689.8A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unkn CVE-2025-44695.4A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown funct CVE-2025-44705.4A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is CVE-2025-44717.8A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Affected by this is CVE-2025-44727.8A vulnerability was found in code-projects Departmental Store Management System 1.0. It has been classified as critical. Affected is the fun CVE-2025-44738.8The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() fu CVE-2025-44748.8The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting CVE-2025-44764.3A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client r CVE-2025-44777.2The ThreatSonar Anti-Ransomware from TeamT5 has a Privilege Escalation vulnerability, allowing remote attackers with intermediate privileges CVE-2025-447796.6An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.