CVE-2026-11735

Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

R7000 R7000 Firmware Rax20 and 37 more

CVE-2025-12945

Improper input validation in NETGEAR Nighthawk router R7000P

An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability. This issue affects R7000P: through 1.3.3.154.

CVSS 4.0 · 1.1 Low EPSS 1.1% KEV · Not listed

Vendors

Netgear

Products

R7000p R7000p Firmware

CVE-2026-62658

Post-authentication Command Injection Vulnerability in certain Nighthawk RAX series models

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router.

CVSS 4.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rax43 Rax45 Rax50 and 2 more

CVE-2026-62659

Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points

A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Wax333

CVE-2026-15757

Insufficient input validation vulnerability in NETGEAR DGND3700v1 modem router

A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Dgnd3700

CVE-2026-62655

A DoS vulnerability due to stack overflow exists in certain NETGEAR Orbi models

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rbe970 Rbe971 Rbr860 and 5 more

CVE-2026-62657

Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models

A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Mr70 Ms70 Raxe500 and 1 more

CVE-2026-62656

Post-authenticated command injection vulnerability found in certain NETGEAR RAX models

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Raxe450 Raxe500

CVE-2023-24498

Netgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials.

An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Prosafe Fs726tp Prosafe Fs726tp Firmware

CVE-2026-0416

Improper input validation in certain NETGEAR routers allows unauthorized modification of protected router functionality

An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local network access to submit crafted input that bypasses intended management interface restrictions, resulting in unauthorized modification of protected router software or functionality.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Raxe450 Raxe450 Firmware Raxe500 and 1 more

CVE-2026-0414

Insufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR Routers

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rbe970 Rbe970 Firmware Rbe97x

CVE-2026-0411

A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi Satellites

An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to gain administrator access to the Orbi router. The listed NETGEAR models are affected by this vulnerability. Orbi WiFi Systems without satellite devices are not impacted by this issue.

CVSS 4.0 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rbe970 Rbe970 Firmware Rbe97x and 8 more

CVE-2026-0420

Missing TLS certificate validation in NETGEAR's ReadyCloud client app

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle (MiTM) style attacks impacting the product's confidentiality. This vulnerability affects the listed NETGEAR models.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rax120 Rax120 Firmware Rax120v1 and 7 more

CVE-2026-9213

Insufficient input validation in certain NETGEAR routers

A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Mr70 Mr70 Firmware Ms70 and 5 more

CVE-2026-0413

Buffer overflow vulnerability in certain NETGEAR Nighthawk routers

A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rbe370 Rbe370 Firmware Rbe37x and 27 more

CVE-2026-9211

Certain NETGEAR routers allow unauthenticated users to gain control of the router

An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Cax30 Cax30 Firmware Rax30 and 5 more

CVE-2026-9210

Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Ex3700 Ex3700 Firmware Ex3800 and 59 more

CVE-2026-3088

Unauthenticated users can disrupt router operation

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rbe970 Rbe970 Firmware Rbe971 and 15 more

CVE-2026-0419

Insufficient input validation vulnerability in NETGEAR JR6150

Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no further security updates are planned. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates. This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Jr6150 Jr6150 Firmware

CVE-2026-0418

Certain NETGEAR devices allow administrators to tamper with system

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Cbr750 Cbr750 Firmware Ex6120 and 67 more