EUVD-2026-44325
GHSA-fj97-xjm9-5vjr
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A for LAN-only attack surface, PR:H for required admin authentication, AC:H to reflect AT:P attack precondition; integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router.
AnalysisAI
Post-authentication command execution in NETGEAR Nighthawk RAX-series routers (RAX43, RAX45, RAX50, RAX54S, RAX54Sv2) permits an attacker already holding administrative credentials and adjacent network access to run unauthorized OS-level commands or code on the device. Rooted in CWE-20 (Improper Input Validation), the flaw bypasses authorization controls within the authenticated management session, yielding high integrity impact on the vulnerable system. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists; a vendor-released patch is available from NETGEAR.
Technical ContextAI
The affected hardware is the NETGEAR Nighthawk RAX Wi-Fi router line - prosumer 802.11ax (Wi-Fi 6) routers commonly deployed in homes and small offices. Confirmed affected models per CPE strings are RAX43, RAX45, RAX50, RAX54S, and RAX54Sv2 (all firmware versions). The root cause class is CWE-20 (Improper Input Validation): the router's management interface - typically a web-based admin panel - fails to adequately sanitize or validate user-supplied input before passing it to underlying OS or firmware routines. In embedded router firmware, this pattern most commonly manifests as command injection, where crafted parameter values are concatenated into shell commands without escaping. The CVSS 4.0 vector (AV:A) confirms the attack surface is the LAN-facing management interface rather than a WAN-exposed service, consistent with typical NETGEAR router architecture where the admin UI is bound to the local subnet. The AT:P metric signals that a specific deployment condition or preconfiguration state must be present for exploitation to succeed.
RemediationAI
Patch available per vendor advisory - apply the firmware update for your specific router model immediately. NETGEAR has published support pages with patched firmware downloads at https://www.netgear.com/support/product/rax43/, https://www.netgear.com/support/product/rax45/, https://www.netgear.com/support/product/rax50/, and https://www.netgear.com/support/product/rax54sv2/ (note: no direct advisory link was provided for RAX54S - check the NETGEAR security advisory page directly). Exact patched firmware version numbers are not specified in the available data and must be confirmed at the vendor support pages before deploying. Until patching is complete, apply compensating controls: disable remote management if it is enabled (this reduces exposure, though the primary attack vector is already AV:A); restrict admin interface access to known management hosts using the router's access control settings; and replace any default or weak admin passwords with strong, unique credentials, as PR:H exploitation requires valid admin authentication. Disabling guest network access and segmenting untrusted LAN devices reduces the pool of adjacent-network actors who could reach the management interface.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a netw
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authentic
Stack-based buffer overflow across ten NETGEAR RAX-series WiFi 6 routers allows a device administrator with adjacent net
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today