CVE-2025-44658 | BDVDB-2026-287017 Detail

Description#

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-07-21Record published in the CVE List.
2. Version 22025-08-07Most recent update recorded in the CVE List.