CVE-2025-5495

A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This issue appears to have been circulating as an 0day since 2024.

• CWE-287

• https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.310911Permissions Required, VDB Entry
• https://vuldb.com/?id.310911Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.584939Third Party Advisory, VDB Entry
• https://www.netgear.com/Product
• https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.mdExploit, Third Party Advisory

Published

Jun 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54944An unrestricted upload of file with dangerous type vulnerabi…9.8
• CVE-2025-54945An external control of file name or path vulnerability in SU…9.8
• CVE-2025-54946A SQL injection vulnerability in SUNNET Corporate Training M…9.8
• CVE-2025-54947In Apache StreamPark versions 2.0.0 through 2.1.7, a securit…9.8
• CVE-2025-54948A vulnerability in Trend Micro Apex One (on-premise) managem…9.8
• CVE-2025-54949A heap buffer overflow vulnerability in the loading of Execu…9.8
• CVE-2025-54950An out-of-bounds access vulnerability in the loading of Exec…9.8
• CVE-2025-54951A group of related buffer overflow vulnerabilities in the lo…9.8
• CVE-2025-54952An integer overflow vulnerability in the loading of ExecuTor…9.8
• CVE-2025-54955OpenNebula Community Edition (CE) before 7.0.0 and Enterpris…8.1
• CVE-2025-54956The gh package before 1.5.0 for R delivers an HTTP response …3.2
• CVE-2025-54957An issue was discovered in Dolby UDC 4.5 through 4.13. A cra…9.8