CVE-2026-0419

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0419", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "state": "PUBLISHED", "assignerShortName": "NETGEAR", "dateReserved": "2025-12-03T04:16:25.919Z", "datePublished": "2026-06-09T15:50:46.210Z", "dateUpdated": "2026-06-10T16:07:19.018Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-06-10T16:07:19.018Z"}, "title": "Insufficient input validation vulnerability in NETGEAR JR6150", "datePublic": "2026-06-09T09:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}, {"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "NETGEAR", "product": "JR6150", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.0.1.26", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands.\u00a0NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no \nfurther security updates are planned. NETGEAR\u00a0strongly recommends \nreplacing these devices with newer NETGEAR models to ensure continued \nsecurity support and updates.\n\n\n\nThis vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands.&nbsp;NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no \nfurther security updates are planned. NETGEAR&nbsp;strongly recommends \nreplacing these devices with newer NETGEAR models to ensure continued \nsecurity support and updates.</p><p>This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.</p>"}]}], "tags": ["unsupported-when-assigned"], "references": [{"url": "https://www.netgear.com/support/product/jr6150"}, {"url": "https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber"}}], "solutions": [{"lang": "en", "value": "NETGEAR JR6150 has reached End-of-Support phase, and no further security updates are planned. NETGEAR\u00a0strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.\n\nProductFixed VersionJR6150 (EoS) AC750 WiFi Router 802.11ac Dual Band GigabitEOS\n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>NETGEAR JR6150 has reached End-of-Support phase, and no further security updates are planned. NETGEAR&nbsp;strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>JR6150 (EoS)</b> AC750 WiFi Router 802.11ac Dual Band Gigabit</td><td>EOS</td></tr></tbody></table><p>Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.</p>"}]}], "credits": [{"lang": "en", "value": "Security Research Center (SRC) @ Concordia University", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-0419"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T03:59:24.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0419", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T17:34:13.322879Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T17:34:21.559Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Insufficient input validation vulnerability in NETGEAR JR6150", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Security Research Center (SRC) @ Concordia University"}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}, {"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NETGEAR", "product": "JR6150", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.1.26"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "NETGEAR JR6150 has reached End-of-Support phase, and no further security updates are planned. NETGEAR\u00a0strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.\n\nProductFixed VersionJR6150 (EoS) AC750 WiFi Router 802.11ac Dual Band GigabitEOS\n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.", "supportingMedia": [{"type": "text/html", "value": "<p>NETGEAR JR6150 has reached End-of-Support phase, and no further security updates are planned. NETGEAR&nbsp;strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>JR6150 (EoS)</b> AC750 WiFi Router 802.11ac Dual Band Gigabit</td><td>EOS</td></tr></tbody></table><p>Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.</p>", "base64": false}]}], "datePublic": "2026-06-09T09:00:00.000Z", "references": [{"url": "https://www.netgear.com/support/product/jr6150"}, {"url": "https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands.\u00a0NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no \nfurther security updates are planned. NETGEAR\u00a0strongly recommends \nreplacing these devices with newer NETGEAR models to ensure continued \nsecurity support and updates.\n\n\n\nThis vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.", "supportingMedia": [{"type": "text/html", "value": "<p>Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands.&nbsp;NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no \nfurther security updates are planned. NETGEAR&nbsp;strongly recommends \nreplacing these devices with newer NETGEAR models to ensure continued \nsecurity support and updates.</p><p>This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-06-10T16:07:19.018Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0419", "state": "PUBLISHED", "dateUpdated": "2026-06-10T16:07:19.018Z", "dateReserved": "2025-12-03T04:16:25.919Z", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "datePublished": "2026-06-09T15:50:46.210Z", "assignerShortName": "NETGEAR"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "JR6150", "vendor": "NETGEAR", "versions": [{"lessThanOrEqual": "1.0.1.26", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:jr6150_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA9FEFBD-FE94-41F0-809F-DF60403ED087", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:jr6150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D67167E5-81D2-4892-AF41-CBB6271232D1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands.\u00a0NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no \nfurther security updates are planned. NETGEAR\u00a0strongly recommends \nreplacing these devices with newer NETGEAR models to ensure continued \nsecurity support and updates.\n\n\n\nThis vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware."}, {"lang": "es", "value": "Validaci\u00f3n de entrada insuficiente en el NETGEAR JR6150 (Router WiFi AC750 802.11ac de doble banda Gigabit lanzado en 2014) permite a los usuarios conectados a las redes WiFi locales ejecutar comandos del sistema operativo. El NETGEAR JR6150 ha alcanzado la fase de fin de soporte a partir de 2018, y no se planean m\u00e1s actualizaciones de seguridad. NETGEAR recomienda encarecidamente reemplazar estos dispositivos con modelos NETGEAR m\u00e1s nuevos para garantizar un soporte y actualizaciones de seguridad continuos.\n\nEsta vulnerabilidad ha sido identificada mediante emulaci\u00f3n de firmware en un entorno de investigaci\u00f3n controlado y no ha sido verificada en hardware de producci\u00f3n."}], "id": "CVE-2026-0419", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0419", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-09T17:17:00.000", "references": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Vendor Advisory"], "url": "https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Product"], "url": "https://www.netgear.com/support/product/jr6150"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.1.26]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "JR6150", "source": "cna", "vendor": "NETGEAR"}, "product": "jr6150", "vendor": "netgear"}], "created": "2026-06-09T17:30:10.524051+00:00", "updated": "2026-06-09T18:00:11.644184+00:00", "vendors": ["netgear", "netgear$PRODUCT$jr6150"]}