EUVD-2026-35459
GHSA-rgvr-gjhw-96v7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network access (LAN/Wi-Fi)
-
DeliveryIdentify target NETGEAR device on segment
-
ExploitSend crafted malformed input to management interface
-
ExecutionBypass input validation and authentication controls
-
ImpactUnauthorized modification of router firmware or configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Adjacency to the target device is required - the attacker must be on the same network segment (LAN, Wi-Fi, or direct link), as enforced by CVSS AV:A. No attack prerequisites are required beyond this (AT:N). The CVSS vector assigns PR:N (no privileges required), and the 'Authentication Bypass' tag indicates that administrative credentials are not reliably enforced as a prerequisite, which directly contradicts the description's framing of 'authenticated administrators' - the more conservative interpretation is that the vulnerability may be reachable without valid credentials. No specific non-default configuration or feature enablement is described as necessary; all listed models in their default firmware state appear to be in scope. Exploitation is limited to adjacent-network attackers only - remote, internet-based exploitation is not indicated by the AV:A vector. No user interaction is required (UI:N). |
| Impact | The CVSS 4.0 base score of 4.9 (Medium) reflects the AV:A constraint as the primary risk-limiting factor: an attacker must be on the same local network segment to exploit this vulnerability. However, within that footprint, the conditions are permissive - AC:L (low complexity), AT:N (no attack prerequisites), and VI:H (high integrity impact). A critical ambiguity exists between the CVSS vector (PR:N, no privileges required) and the description ('authenticated administrators'): the 'Authentication Bypass' tag strongly suggests the flaw can be leveraged to skip authentication entirely, effectively making the PR:N rating accurate despite the description's framing. If authentication bypass is achievable, real-world risk on LAN-adjacent networks is meaningfully higher than the score implies. Exploit maturity is E:U (unreported/unavailable), indicating no public proof-of-concept at time of analysis. The CVE is not listed in the CISA KEV catalog, and no EPSS score was provided in the input data. Given the breadth of affected models (31 distinct firmware lines) and the consumer/SMB deployment context where network segmentation is rarely enforced, the practical attack surface is larger than a single CVSS score communicates. |
| Exploit ScenarioDerived | An attacker connected to the same LAN or Wi-Fi network as a vulnerable NETGEAR device - such as a guest on a home network or an insider on a small business network - sends a crafted input to the router's management interface, exploiting the input validation flaw to bypass authentication and issue unauthorized commands. This allows modification of router firmware, DNS settings, firewall rules, or other software functionality, enabling persistent man-in-the-middle positioning or lateral movement facilitation for the broader network. No public exploit code has been identified at time of analysis (E:U), but the low complexity (AC:L, AT:N) means exploitation would be straightforward once attack primitives are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local network-adjacent modification of router software and functionality. The CVSS 4.0 vector assigns PR:N (no privileges required) and AV:A (adjacent network), yet the CVE description scopes the vulnerability to 'authenticated administrators' - the 'Authentication Bypass' tag supplied by NETGEAR suggests the input validation flaw may itself circumvent authentication controls, reconciling this apparent conflict. Integrity impact is rated High (VI:H) against the vulnerable system, meaning successful exploitation allows unauthorized firmware or configuration modification. No public exploit is identified at time of analysis (E:U), and this CVE is not listed in the CISA KEV catalog.
RemediationAI
Vendor-released patches are available for all affected models; administrators should upgrade to the fixed firmware versions listed per model (see affected_products for exact thresholds). NETGEAR publishes firmware directly through its support portal - consult the product-specific pages such as https://www.netgear.com/support/product/ex3700/, https://www.netgear.com/support/product/mr60/, https://www.netgear.com/support/product/r6900p/, and equivalent pages for each device. As a compensating control prior to patching, restrict wireless and wired LAN access to the router's administrative interface by enabling NETGEAR's access control features to whitelist specific MAC addresses or management IP ranges, reducing the pool of adjacent-network hosts that can reach the management plane. Disabling remote management (if not already disabled by default) eliminates the WAN attack surface entirely, though this does not address the LAN-side AV:A vector. Note that given the PR:N and Authentication Bypass tag, password rotation alone is unlikely to be an effective mitigating control if the flaw bypasses authentication before credentials are checked.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-20 (Improper Input Validation) is the root cause - the router firmware fails to adequately sanitize or validate input supplied to an administrative interface accessible from the adjacent network. The affected product families span NETGEAR's EX-series Wi-Fi range extenders (EX3700, EX3800, EX6120, EX6130), Orbi Pro mesh routers and satellites (MR60, MR70, MR80, MS60, MS70, MS80), and a wide set of consumer and enthusiast routers (R6400v2, R6700v3, R6900P, R7000, R7000P, R7960P, R8000P, R8500, XR1000, and multiple RAX/RAXE AX-series models). The CPE strings (cpe:2.3:a:netgear:*) confirm these are firmware-level application vulnerabilities, not hardware defects. The CVSS 4.0 attack vector of AV:A constrains exploitation to the local network segment (LAN or Wi-Fi), meaning the attacker must already have adjacency - typically sharing the same subnet or wireless network as the device.
Know when R7000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber
Primary rating from Vendor (NETGEAR) · only source for this CVE.
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
2DescriptionCVE.org
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Insufficient input validation across three NETGEAR router models - R7000, RAXE500, and RS700 - permits authenticated adm
Authenticated administrators on the local network of NETGEAR CBR40, R7000, R7000P, and RAX40 routers can execute unautho
**Potential prompt injection detected — flagging before proceeding.** The CVE data you provided contains an embedded "E
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Exploit-DB