VulnerabilityAnalyzed

CVE-2025-12940

Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points).

LOW 0.5EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points). An user having access to the syslog server can read the logs containing these credentials. This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4. Devices managed with Insight get automatic updates. If not, please check the firmware version and update to the latest. Fixed in: WAX610 firmware 11.8.0.10 or later. WAX610Y firmware 11.8.0.10 or later.

CVSS 4.0: 0.5 LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-532
Affected: netgear/wax610y firmware · netgear/wax610 firmware
Source: a2826606-91e7-4eb6-899e-8484bd4575d5

References

https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025Vendor Advisory
https://www.netgear.com/support/product/wax610Product
https://www.netgear.com/support/product/wax610yProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.