CVE-2026-11731

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11731", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "state": "PUBLISHED", "assignerShortName": "NETGEAR", "dateReserved": "2026-06-09T02:46:39.902Z", "datePublished": "2026-10-13T14:41:42.298Z", "dateUpdated": "2026-10-16T13:58:30.825Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-10-16T13:58:30.825Z"}, "title": "Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models", "datePublic": "2026-10-13T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-288", "description": "CWE-288 Authentication bypass using an alternate path or channel", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "NETGEAR", "product": "RAX30", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX29", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX28", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device\u2019s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device\u2019s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.</p>"}]}], "references": [{"url": "https://www.netgear.com/support/product/rax30", "tags": ["product", "patch"]}, {"url": "https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/V:D/U:Amber"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionRAX28 Nighthawk AX5 5-Stream AX2200 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax28 RAX29 Nighthawk AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax29 RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax30", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>RAX28</b> Nighthawk AX5 5-Stream AX2200 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax28\">v1.0.15.110</a></td></tr><tr><td><b>RAX29</b> Nighthawk AX2400 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax29\">v1.0.15.110</a></td></tr><tr><td><b>RAX30</b> Nighthawk AX5 5-Stream AX2400 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax30\">v1.0.15.110</a></td></tr></tbody></table>"}]}], "credits": [{"lang": "en", "value": "Yanming Chen of Guangzhou University", "type": "finder"}, {"lang": "en", "value": "Michael Gentile", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-11731"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T03:59:11.952Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11731", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-13T15:18:25.294255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T15:40:47.964Z"}}], "cna": {"title": "Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Yanming Chen of Guangzhou University"}, {"lang": "en", "type": "finder", "value": "Michael Gentile"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "YES", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/V:D/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NETGEAR", "product": "RAX30", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX29", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAX28", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionRAX28 Nighthawk AX5 5-Stream AX2200 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax28 RAX29 Nighthawk AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax29 RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax30", "supportingMedia": [{"type": "text/html", "value": "<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>RAX28</b> Nighthawk AX5 5-Stream AX2200 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax28\">v1.0.15.110</a></td></tr><tr><td><b>RAX29</b> Nighthawk AX2400 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax29\">v1.0.15.110</a></td></tr><tr><td><b>RAX30</b> Nighthawk AX5 5-Stream AX2400 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax30\">v1.0.15.110</a></td></tr></tbody></table>", "base64": false}]}], "datePublic": "2026-10-13T00:00:00.000Z", "references": [{"url": "https://www.netgear.com/support/product/rax30", "tags": ["product", "patch"]}, {"url": "https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device\u2019s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.", "supportingMedia": [{"type": "text/html", "value": "<p>An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device\u2019s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication bypass using an alternate path or channel"}]}], "providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-10-16T13:58:30.825Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11731", "state": "PUBLISHED", "dateUpdated": "2026-10-16T13:58:30.825Z", "dateReserved": "2026-06-09T02:46:39.902Z", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "datePublished": "2026-10-13T14:41:42.298Z", "assignerShortName": "NETGEAR"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RAX30", "vendor": "NETGEAR", "versions": [{"lessThan": "v1.0.15.110", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX29", "vendor": "NETGEAR", "versions": [{"lessThan": "v1.0.15.110", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAX28", "vendor": "NETGEAR", "versions": [{"lessThan": "v1.0.15.110", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device\u2019s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions."}], "id": "CVE-2026-11731", "lastModified": "2026-10-16T14:17:24.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11731", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-10-13T15:17:43.510", "references": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "url": "https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "url": "https://www.netgear.com/support/product/rax30"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v1.0.15.110)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "RAX28", "source": "cna", "vendor": "NETGEAR"}, "product": "rax28", "vendor": "netgear"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v1.0.15.110)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "RAX29", "source": "cna", "vendor": "NETGEAR"}, "product": "rax29", "vendor": "netgear"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v1.0.15.110)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "RAX30", "source": "cna", "vendor": "NETGEAR"}, "product": "rax30", "vendor": "netgear"}], "created": "2026-10-13T17:30:13.566437+00:00", "updated": "2026-10-13T17:30:14.011689+00:00", "vendors": ["netgear", "netgear$PRODUCT$rax28", "netgear$PRODUCT$rax29", "netgear$PRODUCT$rax30"]}