CVE-2025-52081: netgear xr300_firmware Stack-based Buffer Overflow

Vulnerability summary

CVE-2025-52081 is a medium (CVSS 6.5) Stack-based Buffer Overflow vulnerability in netgear xr300_firmware. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-07-2025
   PublishedVulnerability first disclosed.
2. 15-07-2025
   Last modifiedVulnerability information updated.

Description

In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the usb_folder parameter.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).