EUVD-2026-56191
GHSA-g6fv-h3pw-rwgm
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Amber
Adjacent network access and high-privilege admin credentials required; impact is limited to low, transient availability disruption with no confidentiality or integrity loss.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.
AnalysisAI
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authenticated administrator with adjacent network access to crash affected devices, causing temporary service unavailability. Affected hardware spans the MR, MS, and RAX product lines across at least 15 models and carries a CVSS 4.0 score of 1.1, reflecting the high-privilege prerequisite and narrow impact scope limited to transient availability loss. No public exploits exist and no active exploitation has been reported; vendor firmware patches are available through NETGEAR per-product support pages.
Technical ContextAI
CWE-121 (Stack-based Buffer Overflow) identifies the root cause: a firmware function writes beyond the bounds of a stack-allocated buffer, corrupting adjacent stack frames and triggering a crash or device reset. The flaw resides in NETGEAR embedded firmware across their consumer and prosumer wireless product lines, including MR-series mesh satellites (MR70, MR90), MS-series mesh nodes (MS70, MS90), and RAX-series WiFi 6/6E routers (RAX41, RAX41v2, RAX42, RAX42v2, RAX43, RAX43v2, and per vulnerability tags also RAX49S, RAX50, RAX50v2, RAX54S, RAX54Sv2). CPE strings use a wildcard version specifier, indicating all firmware versions of each listed model are considered affected until patched. The CVSS 4.0 vector specifies AV:A (Adjacent), meaning the exploit interface is reachable only from the same Layer-2/Layer-3 network segment as the device - typically the local LAN or management VLAN.
RemediationAI
Apply the latest firmware update for each affected device via the NETGEAR per-product support pages: MR70 at https://www.netgear.com/support/product/mr70/, MR90 at https://www.netgear.com/support/product/mr90/, MS70 at https://www.netgear.com/support/product/ms70/, MS90 at https://www.netgear.com/support/product/ms90/, RAX41 at https://www.netgear.com/support/product/rax41/, RAX41v2 at https://www.netgear.com/support/product/rax41v2/, RAX42 at https://www.netgear.com/support/product/rax42/, RAX42v2 at https://www.netgear.com/support/product/rax42v2/, RAX43 at https://www.netgear.com/support/product/rax43/, RAX43v2 at https://www.netgear.com/support/product/rax43v2/, RAX49S at https://www.netgear.com/support/product/rax49s/, and RAX50/RAX50v2 at their respective support pages. Patch availability is confirmed by vendor; exact patched firmware version numbers are not specified in available data and must be verified on each support page directly. As a compensating control prior to patching, restrict device administrator credentials to a small number of trusted individuals and ensure the admin interface is accessible only from a dedicated management VLAN or host - this eliminates the PR:H and AV:A prerequisites simultaneously with no material operational side effects.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a netw
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Stack-based buffer overflow across ten NETGEAR RAX-series WiFi 6 routers allows a device administrator with adjacent net
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today