EUVD-2026-56189
GHSA-h63q-877w-c3r8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber
Adjacent-network access and authenticated admin required (AV:A, PR:H); integrity-only impact with no confidentiality or availability consequence.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.
AnalysisAI
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to push unauthorized modifications to device software and functionality. Affected models span at least ten RAX variants (RAX20 through RAX50) per CPE data, with tags suggesting additional models including RAX54S and RAX54Sv2. The CVSS 4.0 score of 4.3 reflects the high-privilege, adjacent-network prerequisite that substantially limits real-world exploitation surface; no public exploit has been identified at time of analysis, and a vendor-released patch is available across all listed product pages.
Technical ContextAI
CWE-20 (Improper Input Validation) indicates the device firmware accepts and processes administrator-supplied input without adequate sanitization or boundary checks, permitting inputs outside the expected range or type that alter device software state. The CVSS 4.0 vector AV:A confirms exploitation is constrained to the adjacent network (LAN or Wi-Fi segment), ruling out remote internet-based attack paths. Affected products per CPE strings are NETGEAR RAX20, RAX41, RAX41v2, RAX42, RAX42v2, RAX43, RAX43v2, RAX45, RAX49S, and RAX50 - all consumer and prosumer Wi-Fi 6 routers. Tags extend this list to RAX50V2, RAX54S, and RAX54Sv2. The vulnerability lies in the firmware's administrative interface input handling, where the attacker's control over device configuration inputs is not constrained to safe values, enabling modification of software and functional behavior beyond intended administrative boundaries.
RemediationAI
The primary remediation is to apply the vendor-released firmware update available from NETGEAR's support pages for each affected model; navigate to the relevant product support page (e.g., https://www.netgear.com/support/product/rax20/) to download and install the latest firmware. Exact patched version numbers are not independently confirmed in the provided data and must be verified from the product-specific advisory. As a compensating control while patching is pending, restrict administrative access to the device management interface by ensuring only trusted, named administrators hold local admin credentials, and confirm that the router's management interface is not exposed beyond the local LAN segment (i.e., remote management should be disabled if not required - this is typically off by default on NETGEAR RAX devices). Rotating admin credentials if any unauthorized access is suspected reduces exposure. There is no known workaround that eliminates the underlying input validation flaw without applying the firmware patch.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a netw
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today