Is there a patch available for CVE-2026-62659?

Yes, a patch is available for CVE-2026-62659. Update the affected software to the latest version immediately.

NETGEAR WAX333 CVE-2026-62659

Q: What is the CVSS score of CVE-2026-62659?

CVE-2026-62659 has a CVSS 4.0 base score of 4.3 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber. EPSS exploitation probability: 0.2%.

EUVD-2026-44331 MEDIUM

Improper Input Validation (CWE-20)

2026-07-14 NETGEAR

GHSA-48qr-2xw5-xvf9

Authentication Bypass Netgear Wax333

4.3

CVSS 4.0 · Vendor: NETGEAR

Severity by source

Vendor (NETGEAR) PRIMARY

4.3 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber

vuln.today AI

4.5 MEDIUM

Adjacent vector and high-privilege requirement reflect LAN-only access with authenticated session needed; only integrity is impacted via unauthorized configuration writes.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (NETGEAR).

CVSS VectorVendor: NETGEAR

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 15:31 vuln.today

DescriptionCVE.org

A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings

AnalysisAI

Improper input validation in the NETGEAR WAX333 Wi-Fi 6 access point permits an already-authenticated, high-privilege user on the adjacent network to bypass authorization controls and make unauthorized changes to device configuration settings. Affected firmware versions are all WAX333 releases below V2.8.0.100, per EUVD-2026-44331 and the July 2026 NETGEAR advisory. No public exploit has been identified and all available signals - EPSS at 0.19%, SSVC exploitation status of none, and a CVSS 4.3 medium score - consistently indicate low real-world urgency.

Technical ContextAI

The NETGEAR WAX333 is a Wi-Fi 6 (802.11ax) access point targeted at SMB and enterprise edge deployments. The root cause is CWE-20 (Improper Input Validation): the device's management interface fails to sufficiently validate or authorize inputs before processing configuration changes, allowing crafted requests to manipulate settings beyond what the authenticated user's role should permit. The CVSS 4.0 vector (AV:A) confirms the attack surface is restricted to the adjacent Layer-2 network - local LAN or associated Wi-Fi - and PR:H confirms a pre-existing high-privilege authenticated session is required. The affected CPE is cpe:2.3:a:netgear:wax333:*:*:*:*:*:*:*:*, covering all firmware revisions in scope prior to the patched release.

RemediationAI

The primary fix is a firmware upgrade to NETGEAR WAX333 version V2.8.0.100 or later, confirmed available from the vendor at https://www.netgear.com/support/product/wax333 and documented in the July 2026 NETGEAR Security Advisory at https://kb.netgear.com/000070859/July-2026-NETGEAR-Security-Advisory. If immediate patching is not feasible, compensating controls should include restricting management interface access to a dedicated out-of-band VLAN, auditing and reducing the number of accounts holding high-privilege credentials to the minimum required, and enforcing network segmentation to limit which hosts can reach the device's management plane. Note that network segmentation does not eliminate the risk for users already on trusted segments with high-privilege accounts. Firmware upgrade remains the definitive resolution.