EUVD-2026-56194
GHSA-c3g8-7w99-c2xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent LAN position
-
DeliveryObtain or abuse admin credentials
-
ExploitSend crafted admin interface request
-
ExecutionTrigger stack-based buffer overflow in firmware
-
PersistOverwrite stack memory to redirect execution
-
ImpactModify router firmware or operational configuration
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three simultaneous conditions: (1) the attacker must be on an adjacent network to the router (AV:A - same LAN segment, not reachable over the public internet); (2) the attacker must possess valid administrative credentials for the router's management interface (PR:H - full admin access, not a lower-privilege user account); and (3) high attack complexity (AC:H) must be met, indicating that exploitation likely requires precise firmware-specific knowledge such as stack offsets or gadget addresses. The impact is bounded to integrity modification of the router's software and functionality - there is no confidentiality or availability impact (VC:N/VA:N). What limits exploitation most significantly is the PR:H prerequisite: an attacker who already has admin access to a router has by definition already achieved a high level of control, making this vulnerability a post-compromise escalation or persistence mechanism rather than an initial access vector. |
| Impact | The CVSS 4.0 score of 1.9 accurately reflects the layered exploitation constraints. AV:A requires the attacker to be on the same local or adjacent network segment as the router - not remotely reachable over the internet. AC:H indicates non-trivial exploitation complexity beyond simply sending a crafted packet. PR:H mandates pre-existing administrative credentials, meaning the attacker must have already compromised admin access through a separate vector or insider knowledge. The impact is integrity-only (VI:H, VC:N, VA:N), limiting the consequence to unauthorized firmware/configuration modification rather than confidentiality breach or denial of service. The threat metrics E:U (no exploit reported), R:U (user-recoverable), and V:D (diffuse value density) further depress real-world urgency. The SSVC U:Amber classification suggests a moderate organizational response posture is warranted but immediate emergency action is not. No EPSS score was provided in the source data, and no KEV listing exists. This is a low-priority finding despite the memory-corruption vulnerability class - the combination of adjacency, high complexity, and admin privilege pre-requisite makes opportunistic mass exploitation implausible. |
| Exploit ScenarioDerived | An attacker who has already obtained administrative credentials to an affected NETGEAR router - via credential reuse, phishing, or a prior compromise - and is positioned on the same LAN segment could send a specially crafted request to the router's admin interface, triggering a stack buffer overflow that allows unauthorized modification of the router's firmware or operational configuration. The high attack complexity (AC:H) means exploitation likely requires precise knowledge of the firmware's stack layout, making casual or automated exploitation unlikely. No public exploit code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin user on an adjacent network to make unauthorized modifications to the router's software and functionality. Exploitation is highly constrained by CVSS 4.0 metrics - adjacent network access, high attack complexity, and pre-existing administrative credentials are all required, yielding an extremely low composite score of 1.9. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing real-world risk well below what the CWE-121 classification alone might suggest.
RemediationAI
Patch available per vendor advisory - apply the latest firmware update for each affected NETGEAR model via the device admin panel or NETGEAR's support pages. NETGEAR has published individual support pages with firmware downloads for each affected model: R7000 at https://www.netgear.com/support/product/r7000/, RAX20 at https://www.netgear.com/support/product/rax20/, RAX35v2 at https://www.netgear.com/support/product/rax35v2/, RAX41/v2, RAX42/v2, RAX43/v2 at their respective support pages, RAX45 at https://www.netgear.com/support/product/rax45/, RAX49S at https://www.netgear.com/support/product/rax49s/, and RAX50/S at https://www.netgear.com/support/product/rax50/. Exact patched firmware version numbers are not independently confirmed in the available data; verify the latest version number on each model's support page before deployment. As a compensating control pending patching, restrict admin panel access to trusted management VLANs or hosts only, and disable remote management if not required - this directly reduces the adjacent-network attacker's ability to authenticate and trigger the overflow. No confidentiality or availability risk reduces urgency, but integrity-based firmware tampering warrants timely patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-121 (Stack-Based Buffer Overflow) describes a class of memory-safety defects in which data written to a stack-allocated buffer exceeds the buffer's allocated size, overwriting adjacent stack memory such as return addresses or saved registers. In embedded router firmware - typical of NETGEAR's ARM/MIPS-based devices - stack overflows can redirect execution flow or corrupt firmware integrity checks, enabling unauthorized software modifications. Affected hardware spans NETGEAR's consumer and prosumer lines: CPE data confirms R7000, RAX20, RAX35v2, RAX41/v2, RAX42/v2, RAX43/v2, and RAX45, while tags extend coverage to RAX49S, RAX50/S/V2, RAX54SV2/V2, RAXE450, RAXE500, XR1000/V2 - indicating a firmware code-sharing pattern across NETGEAR's Wi-Fi 6/6E portfolio.
Know when R7000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:L/U:Amber
AV:A for adjacent-only access, AC:H for exploitation complexity, PR:H for mandatory admin credentials; integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
DescriptionCVE.org
A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Insufficient input validation across three NETGEAR router models - R7000, RAXE500, and RS700 - permits authenticated adm
Authenticated administrators on the local network of NETGEAR CBR40, R7000, R7000P, and RAX40 routers can execute unautho
**Potential prompt injection detected — flagging before proceeding.** The CVE data you provided contains an embedded "E
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Exploit-DB