Command injection vulnerability in some NETGEAR Nighthawk devices

Summary

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Timeline

1. Aug 11, 2026, 12:00 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

2. Aug 11, 2026, 3:06 PM UTCCVE published
3. Aug 12, 2026, 7:44 AM UTCRecord last updated

Affected versions

• NETGEAR MR60

  fixed in V1.1.8.142

• NETGEAR MR70

  fixed in V1.0.4.48

• NETGEAR MR90

  fixed in V1.0.2.46

• NETGEAR MS60

  fixed in V1.1.8.142

• NETGEAR MS70

  fixed in V1.0.4.48

• NETGEAR MS90

  fixed in V1.0.2.46

• NETGEAR RAX20

  fixed in V1.0.17.142

• NETGEAR RAX200

  fixed in V1.0.11.148

• NETGEAR RAX35

  fixed in V1.0.17.142

• NETGEAR RAX35v2

  fixed in V1.0.17.142

• NETGEAR RAX41

  fixed in V1.1.6.36

• NETGEAR RAX41v2

  fixed in V1.1.6.36

• NETGEAR RAX42

  fixed in V1.1.6.36

• NETGEAR RAX42v2

  fixed in V1.1.6.36

• NETGEAR RAX43

  fixed in V1.1.6.36

• NETGEAR RAX43v2

  fixed in V1.1.6.36

• NETGEAR RAX45

  fixed in V1.0.17.142

• NETGEAR RAX49S

  fixed in V1.1.6.36

• NETGEAR RAX50

  fixed in V1.1.6.36

• NETGEAR RAX50v2

  fixed in V1.1.6.36

• NETGEAR RAX54S

  fixed in V1.1.6.36

• NETGEAR RAX54Sv2

  fixed in V1.1.6.36

• NETGEAR RAX80

  fixed in V1.0.11.148

• NETGEAR RAXE500

  fixed in V1.2.14.110

• NETGEAR RS700

  fixed in V1.0.9.6

• NETGEAR XR1000

  fixed in V1.1.0.22

• NETGEAR XR1000v2

  fixed in V1.1.0.22

References 25