CVE-2025-44658

CRITICAL 9.8CVE-2025-44658 · Published 21/07/2025 · updated 17/06/2026

In short

CVE-2025-44658 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.

References

gist.github.com/TPCchecker/c72eea7a3f89070dab7dfdbf7504b2d6 · Broken Link
netgear.com/about/security · Vendor Advisory
notion.so/CVE-2025-44658-24754a1113e780df8f72c779a108f75b · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free