NETGEAR EX Extenders CVE-2026-11730

Exploitation requires ALL of the following concrete preconditions: (1) the attacker must have network-adjacent access to the extender, specifically valid WiFi/network credentials for the device's network (per AV:A and PR:L); (2) an administrator must have an active authenticated session on the device's web management portal, since the attack hijacks an existing session rather than creating one (reflected by AT:P); and (3) the attacker exploits the insufficient session-identifier randomness (CWE-335) to predict the valid token. Limiting factors that reduce real-world risk: the attack cannot be performed remotely over the internet (adjacent only), it depends on a concurrent live admin session, and it is constrained to the specific EX3700 and EX6120 extender models. Exploit maturity is Unreported (E:U) with no POC in the provided data.

This is a genuine but comparatively low-urgency issue, consistent with its Medium 4.5 CVSS 4.0 score. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:L/UI:N) confirms the attack is NOT internet-remote: it requires network adjacency (AV:A) and some level of privilege/access (PR:L), matching the description's requirement that the attacker already hold WiFi credentials to the extender network. Attack Requirements are Present (AT:P), reflecting that a valid administrator session must already exist to be predicted and hijacked - exploitation is opportunistic rather than always-available. Impact is meaningful where it succeeds (VC:H/VI:H = full admin-session confidentiality and integrity compromise), but availability is unaffected (VA:N) and there is no scope change (SC:N/SI:N). Critically, Exploit Maturity is Unreported (E:U) and no EPSS score, KEV listing, or POC was provided, so there is no evidence of active or likely imminent exploitation. No KEV and no POC means this is NOT a drop-everything priority; it is a real defect warranting patching on a normal cadence, gated heavily by the adjacency + pre-existing-admin-session preconditions. EPSS is missing from the input, so exploitation probability cannot be quantified - treat the 'low real-world likelihood' conclusion as inferred from the adjacent vector and unproven exploit maturity, not confirmed.

An attacker who has already joined the local WiFi network (using known, weak, or shared credentials) observes or triggers an administrator logging into the extender's web management portal. Because session identifiers are generated with insufficient randomness (CWE-335), the attacker predicts the valid session token and rides the authenticated session to gain full administrative control of the device. No public exploit code was identified at time of analysis, and the attack is limited to adjacent-network access rather than remote internet exploitation.