EUVD-2026-44328
GHSA-9248-447r-6p88
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only attack vector (AV:A) and high privileges required (PR:H) for authenticated users; scope unchanged; integrity-only impact with no confidentiality or availability consequences.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation.
AnalysisAI
Authenticated command injection in NETGEAR RAXE450 and RAXE500 routers allows a logged-in, network-adjacent user to send specially crafted requests that bypass authorization controls and execute commands outside their permitted scope, enabling unauthorized configuration changes with material integrity impact. Both models running firmware below V1.2.14.114 are affected, and the CVSS 4.0 E:P modifier indicates proof-of-concept exploit code exists, though EPSS remains very low at 0.15% (5th percentile). No public exploit identified at time of analysis beyond the PoC signal, and CISA KEV does not list this CVE, consistent with the SSVC exploitation rating of none.
Technical ContextAI
The affected products - identified by CPE strings cpe:2.3:a:netgear:raxe450 and cpe:2.3:a:netgear:raxe500 - are consumer and prosumer WiFi 6E tri-band routers. The root cause is CWE-20 (Improper Input Validation): the router firmware fails to adequately validate or sanitize input received from authenticated users, allowing crafted HTTP or API requests to the management interface to trigger command execution beyond the user's authorized scope. This is a post-authentication authorization bypass pattern, where the authentication layer is intact but the subsequent command-dispatch logic does not enforce proper privilege separation. The CVSS 4.0 vector (AV:A) confirms the attack surface is the router's adjacent-network management interface, not a remotely reachable internet-exposed endpoint.
RemediationAI
Update RAXE450 and RAXE500 firmware to V1.2.14.114 or later, which addresses this vulnerability per the NETGEAR July 2026 Security Advisory at https://kb.netgear.com/000070859/July-2026-NETGEAR-Security-Advisory. As a compensating control prior to patching, restrict access to the router's management interface to only trusted administrator accounts and ensure no untrusted users hold active login credentials - this directly limits the PR:H attack surface since exploitation requires authenticated access. Additionally, disabling remote or LAN-based management access for non-administrative accounts reduces the adjacent-network exposure (AV:A). Note that firmware updates on home/prosumer routers may require a reboot and brief connectivity interruption.
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
Improper input validation in NETGEAR RAXE450 and RAXE500 routers (firmware prior to V1.2.14.114) allows authenticated ad
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today