Insufficient input validation in certain NETGEAR routers

Summary

Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorized changes to router software and functionality.

Timeline

1. Jun 9, 2026, 3:41 PM UTCCVE published
2. Jun 9, 2026, 5:27 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 10, 2026, 3:24 PM UTCRecord last updated

Affected versions

• NETGEAR R7000

  fixed in V1.0.11.216

• NETGEAR RAX20

  fixed in V1.0.18.144

• NETGEAR RAX35v2

  fixed in V1.0.16.132

• NETGEAR RAX41

  fixed in V1.0.16.132

• NETGEAR RAX41v2

  fixed in V1.1.4.28

• NETGEAR RAX42

  fixed in V1.0.16.132

• NETGEAR RAX42v2

  fixed in V1.1.4.28

• NETGEAR RAX43

  fixed in V1.0.16.132

• NETGEAR RAX43v2

  fixed in V1.1.4.28

• NETGEAR RAX45

  fixed in V1.0.16.132

• NETGEAR RAX49S

  fixed in V1.1.4.28

• NETGEAR RAX50

  fixed in V1.0.16.132

• NETGEAR RAX50S

  fixed in V1.0.16.132

• NETGEAR RAX50v2

  fixed in V1.1.4.28

• NETGEAR RAX54Sv2

  fixed in V1.1.4.28

• NETGEAR RAX54v2

  fixed in V1.1.4.28

• NETGEAR RAXE450

  fixed in V1.2.14.114

• NETGEAR RAXE500

  fixed in V1.2.14.114

• NETGEAR XR1000

  fixed in V1.1.0.22

• NETGEAR XR1000v2

  fixed in V1.1.0.22

References 20