EUVD-2026-56192
GHSA-g2h4-h77j-p83h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN adjacency (compromise host or ARP spoof)
-
DeliveryEstablish active MITM position on local segment
-
ExploitIdentify target Nighthawk device traffic stream
-
ExecutionIntercept and modify in-transit network data
-
PersistInject OS command payload into unvalidated field
-
ImpactExecute arbitrary commands on device firmware
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be network-adjacent (on the same LAN segment or WLAN) AND must be able to actively intercept and modify local network traffic - a man-in-the-middle position. This is confirmed by both the CVE description and the CVSS 4.0 AT:P (Specific Attack Requirements: Present) metric. Exploitation over the internet or from a remote network is not possible without first achieving LAN access. The MITM requirement means passive eavesdropping is insufficient - the attacker must be able to actively modify in-flight packets. What limits exploitation: (1) physical or logical adjacency to the target LAN is mandatory; (2) active traffic modification capability (e.g., ARP spoofing, rogue AP, compromised switch) must be established before the command injection can be triggered; (3) no specific non-default configuration is mentioned as required beyond normal device operation. |
| Impact | The CVSS 4.0 base score of 4.9 reflects the meaningful complexity barriers built into this attack: AV:A limits exposure to physically or logically adjacent network segments, AC:H reflects the elevated attack complexity, and AT:P indicates a specific prerequisite (MITM positioning) must be met before exploitation is possible. The E:U supplemental metric (exploitation unreported) and U:Amber urgency rating align with the absence of any KEV listing or published proof-of-concept code. Despite a high confidentiality and integrity impact on the vulnerable system (VC:H/VI:H), the real-world risk is moderated substantially by the requirement for an attacker to have already established a privileged network position. This is not a drive-by or remote internet-facing vulnerability - it requires lateral movement or physical proximity to the local network first. EPSS data is not available in the provided intelligence; no KEV listing exists to confirm opportunistic mass exploitation. V:D (Value Density: Diffuse) and RE:L (Recovery: Low) in the CVSS supplemental metrics further support that this is a targeted rather than widespread threat. In summary: high impact if exploited but a credible threat primarily in targeted attacks, insider threat scenarios, or environments with poor network segmentation. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the local network - via a compromised host, rogue access point, or ARP poisoning - positions themselves between a Nighthawk device and a communicating endpoint (such as a firmware update server or a management service). The attacker intercepts and modifies the network traffic in transit, injecting OS-level command sequences into data fields the device firmware processes without sanitization, ultimately achieving arbitrary command execution on the router or mesh node with no credentials required on the target device itself. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches.
RemediationAI
Apply the latest firmware update for each affected device via the NETGEAR support portal. Per-model patch pages are available at https://www.netgear.com/support/product/mr60/, mr70, mr90, ms60, ms70, ms90, rax20, rax35, rax35v2, rax41, rax41v2, rax42, rax42v2, rax43, rax200, and additional models listed in the references. Exact fixed firmware version numbers are not specified in the available intelligence - confirm the minimum patched version on each product's support page before marking remediation complete. As a compensating control pending patch deployment, network administrators should enable client isolation on wireless segments hosting Nighthawk devices, enforce DHCP snooping and dynamic ARP inspection on managed switches to prevent ARP-based MITM attacks, and restrict LAN-side management traffic to dedicated VLANs accessible only to authorized administrators. Note that ARP inspection requires managed switch infrastructure and may not be available in all home environments.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the device firmware passes attacker-controlled network data to a shell interpreter without adequate sanitization. The CVSS 4.0 vector (AV:A/AC:H/AT:P) confirms the attack surface is limited to the adjacent network segment, with a specific prerequisite of traffic interception capability - likely targeting a firmware update channel, a network management service, or an unauthenticated daemon that processes data received over the LAN. Affected products span consumer and prosumer Nighthawk hardware including mesh satellite nodes (MR60, MR70, MR90, MS60, MS70, MS90) and WiFi routers (RAX20, RAX35, RAX35v2, RAX41, RAX42, RAX43, RAX45, RAX49S, RAX50, RAX50v2, RAX54S, RAX54Sv2, RAX80, RAX200, RAXE500, RS700, XR1000, XR1000v2), as identified via CPE strings and product tags.
Know when Rax20 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber
Adjacent network vector and mandatory MITM prerequisite justify AV:A and AC:H; PR:N because no credentials on the target device are required; no availability impact per description.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
DescriptionCVE.org
A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Exploit-DB