EUVD-2026-56192
GHSA-g2h4-h77j-p83h
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber
Adjacent network vector and mandatory MITM prerequisite justify AV:A and AC:H; PR:N because no credentials on the target device are required; no availability impact per description.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.
AnalysisAI
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches.
Technical ContextAI
The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the device firmware passes attacker-controlled network data to a shell interpreter without adequate sanitization. The CVSS 4.0 vector (AV:A/AC:H/AT:P) confirms the attack surface is limited to the adjacent network segment, with a specific prerequisite of traffic interception capability - likely targeting a firmware update channel, a network management service, or an unauthenticated daemon that processes data received over the LAN. Affected products span consumer and prosumer Nighthawk hardware including mesh satellite nodes (MR60, MR70, MR90, MS60, MS70, MS90) and WiFi routers (RAX20, RAX35, RAX35v2, RAX41, RAX42, RAX43, RAX45, RAX49S, RAX50, RAX50v2, RAX54S, RAX54Sv2, RAX80, RAX200, RAXE500, RS700, XR1000, XR1000v2), as identified via CPE strings and product tags.
RemediationAI
Apply the latest firmware update for each affected device via the NETGEAR support portal. Per-model patch pages are available at https://www.netgear.com/support/product/mr60/, mr70, mr90, ms60, ms70, ms90, rax20, rax35, rax35v2, rax41, rax41v2, rax42, rax42v2, rax43, rax200, and additional models listed in the references. Exact fixed firmware version numbers are not specified in the available intelligence - confirm the minimum patched version on each product's support page before marking remediation complete. As a compensating control pending patch deployment, network administrators should enable client isolation on wireless segments hosting Nighthawk devices, enforce DHCP snooping and dynamic ARP inspection on managed switches to prevent ARP-based MITM attacks, and restrict LAN-side management traffic to dedicated VLANs accessible only to authorized administrators. Note that ARP inspection requires managed switch infrastructure and may not be available in all home environments.
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent
Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local networ
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to
Integrity tampering in NETGEAR router and mesh network firmware allows authenticated administrators on the local network
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authent
Stack-based buffer overflow in NETGEAR RAX-series and XR-series routers enables an authenticated administrator, operatin
Stack-based buffer overflow in multiple NETGEAR router models (R7000, RAX and XR series) allows an authenticated admin u
Integrity controls on multiple NETGEAR router firmware lines can be subverted by authenticated administrators on the loc
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today