Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers

Summary

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.

Timeline

1. Aug 11, 2026, 3:06 PM UTCCVE published
2. Aug 12, 2026, 2:41 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 12, 2026, 2:42 PM UTCRecord last updated

Affected versions

• NETGEAR BE9300

  fixed in V1.0.1.84

• NETGEAR MR60

  fixed in V1.1.8.142

• NETGEAR MS60

  fixed in V1.1.8.142

• NETGEAR R6700AX

  fixed in V1.0.18.164

• NETGEAR RAX10

  fixed in V1.0.5.50

• NETGEAR RAX120

  fixed in V1.2.10.56

• NETGEAR RAX120v2

  fixed in V1.2.10.56

• NETGEAR RAX20

  fixed in V1.0.17.142

• NETGEAR RAX28

  fixed in V1.0.14.108

• NETGEAR RAX29

  fixed in V1.0.14.108

• NETGEAR RAX30

  fixed in V1.0.14.108

• NETGEAR RAX36S

  fixed in V1.0.5.50

• NETGEAR RAX43

  fixed in V1.0.17.142

• NETGEAR RAX45

  fixed in V1.0.17.142

• NETGEAR RAX50

  fixed in V1.0.17.142

• NETGEAR RAX70

  fixed in V1.0.19.172

• NETGEAR RBR760

  fixed in V6.3.8.11

• NETGEAR RBS760

  fixed in V6.3.8.11

• NETGEAR RS100

  fixed in V1.0.1.80

• NETGEAR RS200

  fixed in V1.0.1.90

• NETGEAR RS280

  fixed in V1.0.1.90

• NETGEAR RS300

  fixed in V1.0.1.90

• NETGEAR RS500

  fixed in V1.0.1.90

• NETGEAR RS600

  fixed in V1.0.1.90

• NETGEAR RS70

  fixed in V1.0.1.80

• NETGEAR RS90

  fixed in V1.0.1.80

References 25