EUVD-2026-56188
GHSA-7w3c-j7rc-7ffv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local network adjacency
-
DeliveryExecute ARP/DHCP spoofing for MitM position
-
ExploitIntercept device-initiated outbound TLS connection
-
ExecutionPresent forged certificate exploiting CWE-295
-
PersistInject commands into attacker-controlled session
-
ImpactExfiltrate config or modify device state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | The attacker must be physically adjacent to the target network - AV:A in the CVSS vector explicitly excludes remote internet-based exploitation. Beyond adjacency, the attacker must be capable of actively intercepting and modifying local network traffic (i.e., performing a MitM attack via ARP spoofing, rogue DHCP, or equivalent), which the CVSS 4.0 AC:H metric reflects as a high-complexity prerequisite. The target device must also be a region-specific SKU (AT:P in CVSS 4.0); units outside the affected regional configuration are not vulnerable. The CVSS PR:N metric indicates no authentication to the device's management interface is required - the injection opportunity arises from an outbound device-initiated connection, not an inbound attacker-initiated one. Exploitation is therefore limited to: local network access plus active MitM capability, plus presence of the specific affected regional firmware variant. |
| Impact | The CVSS 4.0 score of 4.9 (Medium) is appropriate and arguably not understated given the practical barriers to exploitation. The vector AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N reflects three compounding prerequisites: the attacker must be on the same local network segment (AV:A), must be capable of executing a man-in-the-middle intercept against live traffic (AC:H), and the target device must be a region-specific SKU (AT:P). Despite the High confidentiality and integrity impact on the vulnerable system, these prerequisites substantially reduce real-world exploitability. No EPSS score is available in the provided data to quantify exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been identified. The region-SKU restriction means a significant fraction of deployed NETGEAR devices in this model range are not affected at all. The risk is therefore primarily relevant to network environments where a local adversary can already control or monitor traffic - an attacker already at that level of access has significant alternative capabilities. A discrepancy worth verifying: the description labels this 'command injection' while the assigned CWE is CWE-295 (Improper Certificate Validation); the cert validation failure is the enabler of the injection, and vendors should confirm whether the command injection surface is the update mechanism or another subsystem. |
| Exploit ScenarioDerived | An attacker connected to the same local network as a vulnerable NETGEAR router (for example, a shared Wi-Fi network, a hotel LAN, or an ISP's CGNAT segment) uses ARP spoofing or DHCP poisoning to position themselves between the router and an upstream service. When the device initiates a connection to a firmware update server or cloud management endpoint, the attacker presents a forged TLS certificate that the device accepts without validation; the attacker then injects commands into the now-cleartext or attacker-controlled session, reading sensitive device configuration (confidentiality impact) and modifying device behavior or state (integrity impact). No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent adversary who can intercept and modify local traffic to compromise both the confidentiality and integrity of affected devices. The root cause is CWE-295 (Improper Certificate Validation), meaning the device fails to properly authenticate the remote party during a network exchange - likely firmware update or cloud management traffic - enabling a suitably positioned attacker to inject commands without authenticating to the device. Exploitation is constrained by the requirement for physical network adjacency, active MitM capability, and affected region-specific SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the vendor-released firmware update for your specific affected model via the NETGEAR support page (e.g., https://www.netgear.com/support/product/mr60/ for MR60, with equivalent pages for each model listed in the advisory). Exact fixed firmware version numbers are not specified in the available data - consult the product-specific support page to identify the current patched release. As a compensating control where immediate patching is not feasible, disable or restrict any automatic firmware update or cloud management features that initiate outbound network connections, which eliminates the likely pathway for the certificate-validation failure to be exploited; note this trades reduced attack surface against loss of automatic security update delivery. Segment affected devices onto isolated VLANs with restricted inter-client communication to prevent a co-located attacker from achieving the required MitM position. Verify that your unit is a region-specific SKU before treating this as high priority - models not matching affected regional configurations are not vulnerable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-295 (Improper Certificate Validation) describes a failure to properly verify that a TLS/SSL certificate presented by a remote party is legitimate. On the affected NETGEAR devices, this flaw appears to exist in a network-facing process - likely related to firmware update fetching, cloud telemetry, or remote management - that does not validate the server's certificate chain or hostname. An adjacent attacker can present a forged certificate, intercept the resulting cleartext or attacker-controlled session, and inject OS-level commands. The CPE strings cover NETGEAR's WiFi 6 (AX) and WiFi 7 (BE) product lines: consumer mesh nodes (MR60, MS60, RBR760, RBS760), AX-series routers (RAX10, RAX20, RAX28, RAX29, RAX30, RAX36S, RAX43, RAX45, RAX50, RAX70, RAX120, RAX120V2), the BE9300 (WiFi 7), the R6700AX, and the RS-series (RS70, RS90, RS100, RS200, RS280, RS300, RS500, RS600). The vulnerability is noted as limited to region-specific SKUs, which the CVSS 4.0 metric AT:P (Attack Requirements: Present) captures.
Know when Rax20 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber
Adjacent MitM position required (AV:A/AC:H); no device authentication needed (PR:N); high confidentiality and integrity impact on device; no availability impact stated.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
DescriptionCVE.org
A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a netw
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Exploit-DB