What’s Vulnerable › Vulnerabilities

CVE-2026-62656: Post-authenticated command injection vulnerability found in certain NETGEAR RAX models

• Severity: medium (CVSS 5.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-07-15
• Weakness: CWE-20

Description

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation.

Affected products

• NETGEAR RAXE450: before V1.2.14.114 — fixed in V1.2.14.114
• NETGEAR RAXE500: before V1.2.14.114 — fixed in V1.2.14.114

How to fix

Upgrade to a fixed version: NETGEAR RAXE450 V1.2.14.114; NETGEAR RAXE500 V1.2.14.114. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000070859/July-2026-NETGEAR-Security-Advisory
• https://www.netgear.com/support/product/raxe450/
• https://www.netgear.com/support/product/raxe500/

Get alerted when CVE-2026-62656 or the next vulnerability affects your stack