Rax54S
Monthly
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches.
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authenticated administrator with adjacent network access to crash affected devices, causing temporary service unavailability. Affected hardware spans the MR, MS, and RAX product lines across at least 15 models and carries a CVSS 4.0 score of 1.1, reflecting the high-privilege prerequisite and narrow impact scope limited to transient availability loss. No public exploits exist and no active exploitation has been reported; vendor firmware patches are available through NETGEAR per-product support pages.
Stack-based buffer overflow across ten NETGEAR RAX-series WiFi 6 routers allows a device administrator with adjacent network access to temporarily disrupt normal device operation, producing a transient denial-of-service. The vulnerability carries a CVSS 4.0 score of 1.1, reflecting its highly constrained attack conditions: high-privilege access and adjacent network adjacency are both required, and the only impact is a brief availability disruption with no confidentiality or integrity consequence. No public exploit code exists and the vulnerability is not listed in CISA KEV; NETGEAR has released firmware patches for all affected models.
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to push unauthorized modifications to device software and functionality. Affected models span at least ten RAX variants (RAX20 through RAX50) per CPE data, with tags suggesting additional models including RAX54S and RAX54Sv2. The CVSS 4.0 score of 4.3 reflects the high-privilege, adjacent-network prerequisite that substantially limits real-world exploitation surface; no public exploit has been identified at time of analysis, and a vendor-released patch is available across all listed product pages.
Post-authentication command execution in NETGEAR Nighthawk RAX-series routers (RAX43, RAX45, RAX50, RAX54S, RAX54Sv2) permits an attacker already holding administrative credentials and adjacent network access to run unauthorized OS-level commands or code on the device. Rooted in CWE-20 (Improper Input Validation), the flaw bypasses authorization controls within the authenticated management session, yielding high integrity impact on the vulnerable system. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists; a vendor-released patch is available from NETGEAR.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches.
Stack-based buffer overflow in multiple NETGEAR consumer and prosumer router and mesh system models enables an authenticated administrator with adjacent network access to crash affected devices, causing temporary service unavailability. Affected hardware spans the MR, MS, and RAX product lines across at least 15 models and carries a CVSS 4.0 score of 1.1, reflecting the high-privilege prerequisite and narrow impact scope limited to transient availability loss. No public exploits exist and no active exploitation has been reported; vendor firmware patches are available through NETGEAR per-product support pages.
Stack-based buffer overflow across ten NETGEAR RAX-series WiFi 6 routers allows a device administrator with adjacent network access to temporarily disrupt normal device operation, producing a transient denial-of-service. The vulnerability carries a CVSS 4.0 score of 1.1, reflecting its highly constrained attack conditions: high-privilege access and adjacent network adjacency are both required, and the only impact is a brief availability disruption with no confidentiality or integrity consequence. No public exploit code exists and the vulnerability is not listed in CISA KEV; NETGEAR has released firmware patches for all affected models.
Insufficient input validation in NETGEAR RAX-series Wi-Fi 6 routers allows authenticated local-network administrators to push unauthorized modifications to device software and functionality. Affected models span at least ten RAX variants (RAX20 through RAX50) per CPE data, with tags suggesting additional models including RAX54S and RAX54Sv2. The CVSS 4.0 score of 4.3 reflects the high-privilege, adjacent-network prerequisite that substantially limits real-world exploitation surface; no public exploit has been identified at time of analysis, and a vendor-released patch is available across all listed product pages.
Post-authentication command execution in NETGEAR Nighthawk RAX-series routers (RAX43, RAX45, RAX50, RAX54S, RAX54Sv2) permits an attacker already holding administrative credentials and adjacent network access to run unauthorized OS-level commands or code on the device. Rooted in CWE-20 (Improper Input Validation), the flaw bypasses authorization controls within the authenticated management session, yielding high integrity impact on the vulnerable system. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists; a vendor-released patch is available from NETGEAR.