EUVD-2026-44326
GHSA-h6xv-84v7-xhr4
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Adjacent-only attack with high complexity and no privileges required; full C and I impact on the device with no scope change or availability loss per the described exploit behavior.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device.
AnalysisAI
Certificate validation bypass in NETGEAR XR1000 Gaming Router and Nighthawk models (MR70, MS70, RAXE500) allows an adjacent-network attacker to exploit improper OpenSSL certificate validation (CWE-599) and gain unauthorized remote control of the device. Exploitation requires adjacency to the target network and high attack complexity with specific preconditions (CVSS 4.0 AV:A/AC:H/AT:P), significantly constraining real-world risk despite full confidentiality and integrity impact on the vulnerable device. No public exploit identified at time of analysis; vendor-confirmed patches are available for all four affected models.
Technical ContextAI
CWE-599 (Missing Validation of OpenSSL Certificate) identifies the root cause as the router's failure to adequately validate SSL/TLS certificates during some certificate-based communication or management plane exchange - allowing an attacker to impersonate a trusted endpoint without the device detecting the mismatch. The affected products per CPE data are cpe:2.3:a:netgear:xr1000, cpe:2.3:a:netgear:raxe500, cpe:2.3:a:netgear:ms70, and cpe:2.3:a:netgear:mr70 - a mix of gaming (XR1000) and Nighthawk Wi-Fi 6/6E mesh and router hardware. The flaw likely resides in the firmware's TLS stack used for management communications (e.g., cloud connectivity, remote management, or certificate pinning enforcement), where a malformed or attacker-controlled certificate chain is accepted rather than rejected.
RemediationAI
Apply the vendor-released firmware patches immediately: upgrade XR1000 to V1.0.2.86 or later, RAXE500 to V1.2.14.114 or later, MS70 to V1.0.4.48 or later, and MR70 to V1.0.4.48 or later. Firmware updates can be obtained through the NETGEAR product support pages and the July 2026 NETGEAR Security Advisory at https://kb.netgear.com/000070859/July-2026-NETGEAR-Security-Advisory. As a compensating control for devices that cannot be patched immediately, disable remote management and cloud management features in the router's administration panel to reduce attack surface; this limits administrative flexibility but removes the management-plane exposure. Additionally, segregate the router's management interface from untrusted network segments using VLAN isolation where supported - note this does not eliminate the adjacent-network vector but raises the bar for attacker positioning. Do not expose these devices to shared or public Wi-Fi environments until patched.
Remote code execution affects NETGEAR gaming routers (XR1000, MR70, MS70, RAXE500) when an attacker holds an on-path man
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a netw
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authentic
Same weakness CWE-599 – Missing Validation of OpenSSL Certificate
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today