What’s Vulnerable › Vulnerabilities

CVE-2018-21226

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-28 · updated 2026-06-17
• Weakness: CWE-269

Description

Certain NETGEAR devices are affected by authentication bypass. This affects JNR1010v2 before 1.1.0.48, JWNR2010v5 before 1.1.0.48, WNR1000v4 before 1.1.0.48, WNR2020 before 1.1.0.48, and WNR2050 before 1.1.0.48.

Affected products

• NETGEAR Jnr1010 Firmware: before 1.1.0.48 — fixed in 1.1.0.48
• NETGEAR Jwnr2010 Firmware: before 1.1.0.48 — fixed in 1.1.0.48
• NETGEAR Wnr1000 Firmware: before 1.1.0.48 — fixed in 1.1.0.48
• NETGEAR Wnr2020 Firmware: before 1.1.0.48 — fixed in 1.1.0.48
• NETGEAR Wnr2050 Firmware: before 1.1.0.48 — fixed in 1.1.0.48

How to fix

Upgrade to a fixed version: NETGEAR Jnr1010 Firmware 1.1.0.48; NETGEAR Jwnr2010 Firmware 1.1.0.48; NETGEAR Wnr1000 Firmware 1.1.0.48; NETGEAR Wnr2020 Firmware 1.1.0.48; NETGEAR Wnr2050 Firmware 1.1.0.48. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000055110/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0748
• https://kb.netgear.com/000055110/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0748

Get alerted when CVE-2018-21226 or the next vulnerability affects your stack