CVE-2025-28219

Critical · 9.8

CVSS

9.8

EPSS

12.8%

Published

Mar 28, 2025

CISA due date

—

The record

Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via parameter "deviceName" passed to the binary through a POST request.

Affected packages

Ecosystem	Package	Introduced	Fixed