What’s Vulnerable › Vulnerabilities
CVE-2026-0417: Insufficient input validation in certain NETGEAR routers
- Severity: medium (CVSS 4.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-09 · updated 2026-07-23
- Weakness: CWE-20
Description
Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network to tamper with the router's integrity.
Affected products
- NETGEAR Mr60 Firmware: before 1.1.7.132 — fixed in 1.1.7.132
- NETGEAR Mr70 Firmware: before 1.0.3.28 — fixed in 1.0.3.28
- NETGEAR Mr80 Firmware: before 1.1.7.14 — fixed in 1.1.7.14
- NETGEAR Ms60 Firmware: before 1.1.7.132 — fixed in 1.1.7.132
- NETGEAR Ms70 Firmware: before 1.0.3.28 — fixed in 1.0.3.28
- NETGEAR Ms80 Firmware: before 1.1.7.14 — fixed in 1.1.7.14
- NETGEAR R6400V2 Firmware: before 1.0.4.128 — fixed in 1.0.4.128
- NETGEAR R6700V3 Firmware: before 1.0.4.128 — fixed in 1.0.4.128
- NETGEAR R6900P Firmware: before 1.3.3.152 — fixed in 1.3.3.152
- NETGEAR R7000: before 1.0.11.216 — fixed in 1.0.11.216
- NETGEAR R7000P: before 1.3.3.152 — fixed in 1.3.3.152
- NETGEAR R7960P Firmware: before 1.4.4.92 — fixed in 1.4.4.92
- NETGEAR R8000P Firmware: before 1.4.4.92 — fixed in 1.4.4.92
- NETGEAR R8500 Firmware: all versions
- NETGEAR Rax20 Firmware: before 1.0.18.144 — fixed in 1.0.18.144
- NETGEAR Rax35V2 Firmware: before 1.0.16.132 — fixed in 1.0.16.132
- NETGEAR Rax40V2 Firmware: before 1.0.12.118 — fixed in 1.0.12.118
- NETGEAR Rax41 Firmware: before 1.0.12.118 — fixed in 1.0.12.118
- NETGEAR Rax42 Firmware: before 1.0.12.118 — fixed in 1.0.12.118
- Netgear RAX43: before 1.0.12.120 — fixed in 1.0.12.120
- NETGEAR Rax45 Firmware: before 1.0.12.118 — fixed in 1.0.12.118
- NETGEAR Rax48 Firmware: before 1.0.12.118 — fixed in 1.0.12.118
- NETGEAR Rax50 Firmware: before 1.0.12.120 — fixed in 1.0.12.120
- NETGEAR Rax50S Firmware: before 1.0.12.120 — fixed in 1.0.12.120
- NETGEAR Raxe450 Firmware: before 1.0.10.86 — fixed in 1.0.10.86
- NETGEAR Raxe500 Firmware: before 1.0.10.86 — fixed in 1.0.10.86
- NETGEAR Xr1000 Firmware: before 1.0.0.68 — fixed in 1.0.0.68
How to fix
Upgrade to a fixed version: NETGEAR Mr60 Firmware 1.1.7.132; NETGEAR Mr70 Firmware 1.0.3.28; NETGEAR Mr80 Firmware 1.1.7.14; NETGEAR Ms60 Firmware 1.1.7.132; NETGEAR Ms70 Firmware 1.0.3.28; NETGEAR Ms80 Firmware 1.1.7.14; NETGEAR R6400V2 Firmware 1.0.4.128; NETGEAR R6700V3 Firmware 1.0.4.128; NETGEAR R6900P Firmware 1.3.3.152; NETGEAR R7000 1.0.11.216; NETGEAR R7000P 1.3.3.152; NETGEAR R7960P Firmware 1.4.4.92. Check the vendor advisory for mitigations.
References
- https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
- https://www.netgear.com/support/product/mr60/
- https://www.netgear.com/support/product/mr70/
- https://www.netgear.com/support/product/mr80/
- https://www.netgear.com/support/product/ms60/
- https://www.netgear.com/support/product/ms70/
- https://www.netgear.com/support/product/ms80/
- https://www.netgear.com/support/product/r6400v2/
- https://www.netgear.com/support/product/r6700v3/
- https://www.netgear.com/support/product/r6900p/
- https://www.netgear.com/support/product/r7000/
- https://www.netgear.com/support/product/r7000p/
Get alerted when CVE-2026-0417 or the next vulnerability affects your stack