Affected Vendors This Week
- Fortinet — 1 CVE (High)
- Linksys — 1 CVE (High)
- Netgear — 1 CVE (Medium)
- Digi — 1 CVE (Medium)
- Palo Alto Networks — 3 CVEs (None/Out of Scope)
Critical Vulnerabilities
This week brings two high-severity router vulnerabilities requiring immediate attention from network administrators managing affected deployments.
CVE-2024-52965 (CVSS 7.2) affects Fortinet FortiOS and FortiProxy across multiple versions: FortiOS 7.6.0–7.6.1, 7.4.0–7.4.5, 7.2.0–7.2.10, and before 7.0.16. This is a missing critical authentication step vulnerability (CWE-304) that could allow attackers to bypass security controls. If you manage FortiOS devices, check your current firmware versions immediately and plan upgrades to patched releases.
CVE-2013-3307 (CVSS 8.3) resurfaces in legacy Linksys devices—the E1000 (through 2.1.02), E1200 (before 2.0.05), and E3200 (through 1.0.04). This OS command injection flaw in the apply.cgi ping_ip parameter allows unauthenticated attackers to execute arbitrary commands. While these are older models, they may still exist in distributed networks or branch offices. If present, these devices should be replaced or isolated immediately.
Medium-Severity Issues
CVE-2025-7407 (CVSS 6.3) affects Netgear D6400 firmware 1.0.0.114, enabling OS command injection through the diag.cgi host_name parameter. Netgear users should verify their firmware version and apply available patches.
CVE-2025-38265 (CVSS 5.5) is a kernel-level null pointer dereference in Digi devices using the jsm serial driver. This primarily impacts system stability rather than direct network compromise, but should be addressed during routine maintenance windows.
The three Palo Alto Networks CVEs listed (CVE-2025-0141, CVE-2025-0140, CVE-2025-0139) fall outside router scope—they affect the GlobalProtect App and ADED on macOS endpoints rather than network infrastructure.