{"id":"CVE-2025-12940","aliases":["EUVD-2025-93540","GHSA-43cp-h386-xgfv"],"status":"published","title":"Credentials recorded in logs in NETGEAR WAX610 and WAX610Y","description":"Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610\nand WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6\nAccess Points). An user having access to the syslog server can read the logs containing these credentials. \n\nThis issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.\n\n\nDevices\nmanaged with Insight get automatic updates. If not, please check the firmware version\nand update to the latest. \n\n\n\n\n\nFixed in:\n\n\n\nWAX610 firmware\n11.8.0.10 or later.\n\n\n\nWAX610Y firmware\n11.8.0.10 or later.","severity":{"version":"4.0","score":0.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00291,"percentile":0.21814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-532"],"published":"2025-11-11T16:17:25Z","modified":"2026-10-18T21:10:00Z","products":[{"vendor":"netgear","product":"wax610"},{"vendor":"netgear","product":"wax610_firmware"},{"vendor":"netgear","product":"wax610y"},{"vendor":"netgear","product":"wax610y_firmware"}],"references":[{"url":"https://www.netgear.com/support/product/wax610","tags":["product","patch","Product"]},{"url":"https://www.netgear.com/support/product/wax610y","tags":["product","patch","Product"]},{"url":"https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12940"},{"url":"https://github.com/advisories/GHSA-43cp-h386-xgfv"}],"sources":{"cve":[{"id":"CVE-2025-12940","title":"Credentials recorded in logs in NETGEAR WAX610 and WAX610Y","description":"Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610\nand WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6\nAccess Points). An user having access to the syslog server can read the logs containing these credentials. \n\nThis issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.\n\n\nDevices\nmanaged with Insight get automatic updates. If not, please check the firmware version\nand update to the latest. \n\n\n\n\n\nFixed in:\n\n\n\nWAX610 firmware\n11.8.0.10 or later.\n\n\n\nWAX610Y firmware\n11.8.0.10 or later.","status":"published","published":"2025-11-11T16:17:25.837Z","modified":"2025-11-14T17:41:18.64Z","cvss":[{"version":"4.0","score":0.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber","level":"low","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-93540","description":"Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610\nand WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6\nAccess Points). An user having access to the syslog server can read the logs containing these credentials. \n\nThis issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.\n\n\nDevices\nmanaged with Insight get automatic updates. If not, please check the firmware version\nand update to the latest. \n\n\n\n\n\nFixed in:\n\n\n\nWAX610 firmware\n11.8.0.10 or later.\n\n\n\nWAX610Y firmware\n11.8.0.10 or later.","status":"published","published":"2025-11-11T16:17:25Z","modified":"2025-11-14T17:41:18Z","cvss":[{"version":"4.0","score":0.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber","level":"low"}],"updated_at":"2026-11-02T19:49:16.95916Z"}],"ghsa":[{"id":"GHSA-43cp-h386-xgfv","title":"Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR...","description":"Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610\nand WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6\nAccess Points). An user having access to the syslog server can read the logs containing these credentials. \n\nThis issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.\n\n\nDevices\nmanaged with Insight get automatic updates. If not, please check the firmware version\nand update to the latest. \n\n\n\n\n\nFixed in:\n\n\n\nWAX610 firmware\n11.8.0.10 or later.\n\n\n\nWAX610Y firmware\n11.8.0.10 or later.","status":"published","published":"2025-11-11T18:30:17Z","modified":"2025-12-08T15:31:32Z","cvss":[{"version":"4.0","score":0.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber","level":"low"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:05:05.469565Z"}],"nvd":[{"id":"CVE-2025-12940","description":"Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610\nand WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6\nAccess Points). An user having access to the syslog server can read the logs containing these credentials. \n\nThis issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.\n\n\nDevices\nmanaged with Insight get automatic updates. If not, please check the firmware version\nand update to the latest. \n\n\n\n\n\nFixed in:\n\n\n\nWAX610 firmware\n11.8.0.10 or later.\n\n\n\nWAX610Y firmware\n11.8.0.10 or later.","status":"published","published":"2025-11-11T17:15:39.09Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"4.0","score":0.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber","level":"low","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:11:43.650381Z"}]}}