Insufficient authentication and input validation in certain NETGEAR products

Summary

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Timeline

1. Jun 9, 2026, 3:50 PM UTCCVE published
2. Jun 10, 2026, 3:59 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Jun 11, 2026, 5:03 AM UTCRecord last updated

Affected versions

• NETGEAR LBR1020

  fixed in V2.6.4.60

• NETGEAR LBR20

  fixed in V2.7.6.8

• NETGEAR R6700AX

  All versions

• NETGEAR R7800

  fixed in V1.0.4.96

• NETGEAR R9000

  fixed in V1.0.6.46

• NETGEAR RAX10

  fixed in V1.0.5.50

• NETGEAR RAX10v2

  fixed in V1.0.5.50

• NETGEAR RAX120

  fixed in V1.2.10.56

• NETGEAR RAX120v1

  fixed in V1.2.10.56

• NETGEAR RAX120v2

  fixed in V1.2.10.56

• NETGEAR RAX36S

  fixed in V1.0.5.50

• NETGEAR RAX70

  fixed in V1.0.19.172

• NETGEAR RAX78

  fixed in V1.0.19.172

• NETGEAR RBR10

  through 2.7.6.6

• NETGEAR RBR20

  through 2.7.6.6

• NETGEAR RBR350

  fixed in V4.4.2.1

• NETGEAR RBR40

  through 2.7.6.6

• NETGEAR RBR50

  through 2.7.6.6

• NETGEAR RBS10

  through 2.7.6.6

• NETGEAR RBS20

  through 2.7.6.6

• NETGEAR RBS350

  fixed in V4.4.2.1

• NETGEAR RBS40

  through 2.7.6.6

• NETGEAR RBS50

  through 2.7.6.6

• NETGEAR XR450

  fixed in V2.3.3.136

• NETGEAR XR500

  fixed in v2.3.3.136

References 24