CVE-2025-52082: NETGEAR XR300 Firmware

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the read_access parameter.

Affected products

• NETGEAR XR300 Firmware: version 1.0.3.38 only

Published 2025-07-15. Last modified 2026-06-17.