CVE-2026-11738: Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-23
Weakness: CWE-20

Description

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

Affected products

NETGEAR Be9300 Firmware: before 1.0.1.84 — fixed in 1.0.1.84
NETGEAR Mr60 Firmware: before 1.1.8.142 — fixed in 1.1.8.142
NETGEAR Ms60 Firmware: before 1.1.8.142 — fixed in 1.1.8.142
NETGEAR R6700Ax Firmware: before 1.0.18.164 — fixed in 1.0.18.164
NETGEAR Rax10 Firmware: before 1.0.5.50 — fixed in 1.0.5.50
NETGEAR Rax120 Firmware: before 1.2.10.56 — fixed in 1.2.10.56
NETGEAR Rax120V2 Firmware: before 1.2.10.56 — fixed in 1.2.10.56
NETGEAR Rax20 Firmware: before 1.0.17.142 — fixed in 1.0.17.142
NETGEAR Rax28 Firmware: before 1.0.14.108 — fixed in 1.0.14.108
NETGEAR Rax29 Firmware: before 1.0.14.108 — fixed in 1.0.14.108
NETGEAR RAX30: before 1.0.14.108 — fixed in 1.0.14.108
NETGEAR Rax36S Firmware: before 1.0.5.50 — fixed in 1.0.5.50
Netgear RAX43: before 1.0.17.142 — fixed in 1.0.17.142
NETGEAR Rax45 Firmware: before 1.0.17.142 — fixed in 1.0.17.142
NETGEAR Rax50 Firmware: before 1.0.17.142 — fixed in 1.0.17.142
NETGEAR Rax70 Firmware: before 1.0.19.172 — fixed in 1.0.19.172
NETGEAR Rbr760 Firmware: before 6.3.8.11 — fixed in 6.3.8.11
NETGEAR Rbs760 Firmware: before 6.3.8.11 — fixed in 6.3.8.11
NETGEAR Rs100 Firmware: before 1.0.1.80 — fixed in 1.0.1.80
NETGEAR Rs200 Firmware: before 1.0.1.90 — fixed in 1.0.1.90
NETGEAR Rs280 Firmware: before 1.0.1.90 — fixed in 1.0.1.90
NETGEAR Rs300 Firmware: before 1.0.1.90 — fixed in 1.0.1.90
NETGEAR Rs500 Firmware: before 1.0.1.90 — fixed in 1.0.1.90
NETGEAR Rs600 Firmware: before 1.0.1.90 — fixed in 1.0.1.90
NETGEAR Rs70 Firmware: before 1.0.1.80 — fixed in 1.0.1.80
NETGEAR Rs90 Firmware: before 1.0.1.80 — fixed in 1.0.1.80

How to fix

Upgrade to a fixed version: NETGEAR Be9300 Firmware 1.0.1.84; NETGEAR Mr60 Firmware 1.1.8.142; NETGEAR Ms60 Firmware 1.1.8.142; NETGEAR R6700Ax Firmware 1.0.18.164; NETGEAR Rax10 Firmware 1.0.5.50; NETGEAR Rax120 Firmware 1.2.10.56; NETGEAR Rax120V2 Firmware 1.2.10.56; NETGEAR Rax20 Firmware 1.0.17.142; NETGEAR Rax28 Firmware 1.0.14.108; NETGEAR Rax29 Firmware 1.0.14.108; NETGEAR RAX30 1.0.14.108; NETGEAR Rax36S Firmware 1.0.5.50. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-11738 or the next vulnerability affects your stack