EUVD-2026-56189
GHSA-h63q-877w-c3r8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin credentials via phishing or default password
-
DeliveryGain LAN or Wi-Fi adjacency to target router
-
ExploitAuthenticate to router admin interface
-
ExecutionSubmit crafted malformed input bypassing validation
-
ImpactApply unauthorized firmware or configuration modification
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires two concurrent conditions: (1) the attacker must possess valid administrator credentials for the affected NETGEAR RAX device (PR:H), and (2) the attacker must be connected to the same local network segment as the device (AV:A - LAN or Wi-Fi). Remote internet-based exploitation is not possible per the adjacent-network attack vector. There is no requirement for user interaction (UI:N) once credentials are obtained. Limiting factors include the administrative authentication barrier and the physical/logical network adjacency requirement - an attacker cannot reach this vulnerability from the internet without first gaining LAN presence. Default NETGEAR RAX configurations with strong admin passwords and no unauthorized LAN access are not reachable by unauthenticated remote attackers. |
| Impact | Real-world risk is meaningfully bounded by two hard prerequisites: the attacker must already hold administrator credentials (PR:H) and must be present on the local network or Wi-Fi segment (AV:A). These factors render automated internet-scale exploitation infeasible, consistent with the CVSS 4.0 supplemental metric AU:N (not automatable) and V:D (diffuse value density). The Integrity impact is rated High (VI:H), meaning a successful attacker can fundamentally alter device behavior - potentially flashing rogue firmware, disabling security features, or creating persistent backdoors - but there is no confidentiality or availability impact in the scoring. EPSS data is not provided; however, given E:U (exploit maturity: unreported) and the high-privilege adjacency constraint, exploitation probability is expected to be low. KEV status is not confirmed, and no POC is identified. The primary realistic threat scenario is an insider or a compromised admin credential combined with LAN presence - not an opportunistic remote attacker. The U:Amber urgency and RE:L response effort designations in the supplemental CVSS 4.0 vector align with a 'patch on normal cycle' posture rather than emergency response. |
| Exploit ScenarioDerived | An attacker who has obtained valid administrator credentials - through credential theft, default password abuse, or insider access - and is connected to the same LAN or Wi-Fi segment as the target router submits crafted input to the device's administrative interface that bypasses validation checks. The malformed input causes the firmware to accept unauthorized configuration or software changes, potentially enabling persistent firmware modification or disabling security controls. No public exploit code has been identified at time of analysis, so exploitation currently requires attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to push unauthorized modifications to device software and functionality. Affected models span at least ten RAX variants (RAX20 through RAX50) per CPE data, with tags suggesting additional models including RAX54S and RAX54Sv2. The CVSS 4.0 score of 4.3 reflects the high-privilege, adjacent-network prerequisite that substantially limits real-world exploitation surface; no public exploit has been identified at time of analysis, and a vendor-released patch is available across all listed product pages.
RemediationAI
The primary remediation is to apply the vendor-released firmware update available from NETGEAR's support pages for each affected model; navigate to the relevant product support page (e.g., https://www.netgear.com/support/product/rax20/) to download and install the latest firmware. Exact patched version numbers are not independently confirmed in the provided data and must be verified from the product-specific advisory. As a compensating control while patching is pending, restrict administrative access to the device management interface by ensuring only trusted, named administrators hold local admin credentials, and confirm that the router's management interface is not exposed beyond the local LAN segment (i.e., remote management should be disabled if not required - this is typically off by default on NETGEAR RAX devices). Rotating admin credentials if any unauthorized access is suspected reduces exposure. There is no known workaround that eliminates the underlying input validation flaw without applying the firmware patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-20 (Improper Input Validation) indicates the device firmware accepts and processes administrator-supplied input without adequate sanitization or boundary checks, permitting inputs outside the expected range or type that alter device software state. The CVSS 4.0 vector AV:A confirms exploitation is constrained to the adjacent network (LAN or Wi-Fi segment), ruling out remote internet-based attack paths. Affected products per CPE strings are NETGEAR RAX20, RAX41, RAX41v2, RAX42, RAX42v2, RAX43, RAX43v2, RAX45, RAX49S, and RAX50 - all consumer and prosumer Wi-Fi 6 routers. Tags extend this list to RAX50V2, RAX54S, and RAX54Sv2. The vulnerability lies in the firmware's administrative interface input handling, where the attacker's control over device configuration inputs is not constrained to safe values, enabling modification of software and functional behavior beyond intended administrative boundaries.
Know when Rax20 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber
Adjacent-network access and authenticated admin required (AV:A, PR:H); integrity-only impact with no confidentiality or availability consequence.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
DescriptionCVE.org
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a netw
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Exploit-DB