What’s Vulnerable › Vulnerabilities

CVE-2026-11730: Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-19
• Weakness: CWE-335

Description

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Affected products

• NETGEAR EX3700: before V1.0.0.102 — fixed in V1.0.0.102
• NETGEAR EX6120: before V1.0.1.74 — fixed in V1.0.1.74

How to fix

Upgrade to a fixed version: NETGEAR EX3700 V1.0.0.102; NETGEAR EX6120 V1.0.1.74. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory
• https://www.netgear.com/support/product/ex3700
• https://www.netgear.com/support/product/ex6120

Get alerted when CVE-2026-11730 or the next vulnerability affects your stack