EUVD-2026-56188
GHSA-7w3c-j7rc-7ffv
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber
Adjacent MitM position required (AV:A/AC:H); no device authentication needed (PR:N); high confidentiality and integrity impact on device; no availability impact stated.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.
AnalysisAI
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent adversary who can intercept and modify local traffic to compromise both the confidentiality and integrity of affected devices. The root cause is CWE-295 (Improper Certificate Validation), meaning the device fails to properly authenticate the remote party during a network exchange - likely firmware update or cloud management traffic - enabling a suitably positioned attacker to inject commands without authenticating to the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be physically adjacent to the target network - AV:A in the CVSS vector explicitly excludes remote internet-based exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.9 (Medium) is appropriate and arguably not understated given the practical barriers to exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released firmware update for your specific affected model via the NETGEAR support page (e.g., https://www.netgear.com/support/product/mr60/ for MR60, with equivalent pages for each model listed in the advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a netw
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today