35
CVEs
0
Critical
0
High
0
KEV
0
PoC
0
Unpatched C/H
82.9%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
27
LOW
7
Monthly CVE Trend
Affected Products (30)
Rbr850 Firmware
148
Rbs850 Firmware
146
Rbk852 Firmware
142
Rbr750 Firmware
128
Rbs750 Firmware
127
Rbk752 Firmware
120
R7000P Firmware
99
R9000 Firmware
93
R7800 Firmware
92
R8900 Firmware
90
D7800 Firmware
84
Xr500 Firmware
84
Xr700 Firmware
71
Rbk50 Firmware
70
R7000 Firmware
70
Rbr50 Firmware
69
Rax120 Firmware
69
Rbs50 Firmware
68
Rax80 Firmware
60
R8000 Firmware
59
Rax75 Firmware
57
Rbr20 Firmware
57
Rbs20 Firmware
56
Rbk40 Firmware
55
R6900P Firmware
55
R6700 Firmware
53
Rbs40 Firmware
53
Rbr40 Firmware
52
Rbk20 Firmware
51
Xr300 Firmware
51
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9213 | Remote code execution affects NETGEAR gaming routers (XR1000, MR70, MS70, RAXE500) when an attacker holds an on-path man-in-the-middle position between the device and the internet. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) confirms no privileges are needed on the target device but requires both high attack complexity and a specific network prerequisite - the ability to intercept and tamper with upstream traffic. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.9 | 0.2% | 35 |
|
| CVE-2026-15757 | Unauthorized command execution on NETGEAR DGND3700v1 routers (firmware ≤ V1.0.0.17) is achievable by any unauthenticated attacker present on the same local WiFi or LAN segment, exploiting improper input validation that effectively bypasses authentication controls. The CVSS 4.0 vector (AV:A/PR:N/VC:H/VI:H/VA:H) reflects full confidentiality, integrity, and availability impact on the vulnerable device. No public exploit code or confirmed active exploitation exists; NETGEAR identified this issue and published a July 2026 security advisory, though testing was conducted only against a simulated firmware environment and has not been verified on physical production hardware. | MEDIUM | 6.3 | 0.2% | 32 |
No patch
|
| CVE-2026-62655 | Stack-based buffer overflow in multiple NETGEAR Orbi mesh WiFi models (RBR860, RBRE950/960, RBE970/971, RBS860, RBSE950/960) enables an unauthenticated adjacent-network attacker to crash or force a restart of the affected device, causing a loss of network connectivity. The root cause is CWE-121 (stack-based buffer overflow), meaning a crafted network payload can overwrite stack memory and destabilize the device process. The CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exploit exists, elevating practical risk despite the moderate base score of 5.7. | MEDIUM | 5.7 | 0.2% | 29 |
|
| CVE-2026-9212 | Insufficient authentication (CWE-306) and input validation weaknesses across more than 25 NETGEAR router and mesh system models allow an adjacent-network attacker with low-level privileges to execute arbitrary commands and read sensitive configuration data, or alter certain device settings. The CVSS 4.0 vector confirms the attack is limited to adjacent network segments (AV:A) and requires low privileges (PR:L), with high confidentiality impact on both the vulnerable component and subsequent systems (VC:H, SC:H). No public exploit has been identified at time of analysis, and NETGEAR has self-reported the issue with patches available for all listed product lines. | MEDIUM | 5.6 | 0.1% | 28 |
|
| CVE-2026-62656 | Authenticated command injection in NETGEAR RAXE450 and RAXE500 routers allows a logged-in, network-adjacent user to send specially crafted requests that bypass authorization controls and execute commands outside their permitted scope, enabling unauthorized configuration changes with material integrity impact. Both models running firmware below V1.2.14.114 are affected, and the CVSS 4.0 E:P modifier indicates proof-of-concept exploit code exists, though EPSS remains very low at 0.15% (5th percentile). No public exploit identified at time of analysis beyond the PoC signal, and CISA KEV does not list this CVE, consistent with the SSVC exploitation rating of none. | MEDIUM | 5.4 | 0.2% | 27 |
|
| CVE-2026-9211 | Unauthenticated local-network control of NETGEAR CAX30, RAX30, RAX5, and RAXE300 routers is possible through an authentication bypass rooted in improper input validation (CWE-20). An attacker already present on the local network segment - such as a guest Wi-Fi user, a compromised IoT device, or a rogue actor on the same LAN - can circumvent authentication and gain full administrative control, enabling arbitrary configuration changes, traffic interception, or persistent backdoor installation. No public exploit code has been identified at time of analysis, and NETGEAR has released firmware patches for all four affected product lines. | MEDIUM | 5.2 | 0.0% | 26 |
|
| CVE-2026-11739 | Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches. | MEDIUM | 4.9 | 1.1% | 26 |
|
| CVE-2026-11814 | Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent adversary who can intercept and modify local traffic to compromise both the confidentiality and integrity of affected devices. The root cause is CWE-295 (Improper Certificate Validation), meaning the device fails to properly authenticate the remote party during a network exchange - likely firmware update or cloud management traffic - enabling a suitably positioned attacker to inject commands without authenticating to the device. Exploitation is constrained by the requirement for physical network adjacency, active MitM capability, and affected region-specific SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 4.9 | 0.8% | 25 |
|
| CVE-2026-62657 | Certificate validation bypass in NETGEAR XR1000 Gaming Router and Nighthawk models (MR70, MS70, RAXE500) allows an adjacent-network attacker to exploit improper OpenSSL certificate validation (CWE-599) and gain unauthorized remote control of the device. Exploitation requires adjacency to the target network and high attack complexity with specific preconditions (CVSS 4.0 AV:A/AC:H/AT:P), significantly constraining real-world risk despite full confidentiality and integrity impact on the vulnerable device. No public exploit identified at time of analysis; vendor-confirmed patches are available for all four affected models. | MEDIUM | 4.9 | 0.1% | 25 |
|
| CVE-2026-9210 | Insufficient input validation across 30+ NETGEAR router, range extender, and mesh networking models enables local network-adjacent modification of router software and functionality. The CVSS 4.0 vector assigns PR:N (no privileges required) and AV:A (adjacent network), yet the CVE description scopes the vulnerability to 'authenticated administrators' - the 'Authentication Bypass' tag supplied by NETGEAR suggests the input validation flaw may itself circumvent authentication controls, reconciling this apparent conflict. Integrity impact is rated High (VI:H) against the vulnerable system, meaning successful exploitation allows unauthorized firmware or configuration modification. No public exploit is identified at time of analysis (E:U), and this CVE is not listed in the CISA KEV catalog. | MEDIUM | 4.9 | 0.1% | 25 |
|
| CVE-2026-3088 | Denial-of-service via out-of-bounds write in NETGEAR Orbi mesh router and satellite firmware allows unauthenticated, adjacent-network attackers to render affected devices unavailable by sending specially crafted requests. The vulnerability affects multiple Orbi 860/950/960/970/971-series devices across a broad firmware version range, with fixed builds available per vendor advisory. No public exploit code or active exploitation has been identified at time of analysis (CVSS E:U), though the low attack complexity and absence of any authentication requirement make this straightforward to reproduce for any attacker with local network access. | MEDIUM | 4.9 | 0.0% | 25 |
|
| CVE-2026-0409 | Remote command execution in NETGEAR Orbi 370 series routers (firmware before V12.1.2.7) is achievable by a network-positioned adversary who can intercept and tamper with traffic between the device and the internet. Exploitation requires the device administrator to perform specific management actions while the attacker holds a man-in-the-middle position, at which point a buffer overflow (CWE-119) is triggered allowing arbitrary command execution on the device. No public exploit exists at time of analysis and the vendor has released a patching firmware (V12.1.2.7); no KEV listing has been issued by CISA. | MEDIUM | 4.8 | 0.1% | 24 |
|
| CVE-2026-62658 | Post-authentication command execution in NETGEAR Nighthawk RAX-series routers (RAX43, RAX45, RAX50, RAX54S, RAX54Sv2) permits an attacker already holding administrative credentials and adjacent network access to run unauthorized OS-level commands or code on the device. Rooted in CWE-20 (Improper Input Validation), the flaw bypasses authorization controls within the authenticated management session, yielding high integrity impact on the vulnerable system. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists; a vendor-released patch is available from NETGEAR. | MEDIUM | 4.7 | 0.2% | 24 |
|
| CVE-2026-0420 | TLS certificate validation failure in the ReadyCloud client app on multiple NETGEAR router models exposes confidential data to network interception. The app does not properly validate TLS certificates (CWE-325), enabling a network-positioned attacker to perform man-in-the-middle (MiTM) attacks against ReadyCloud communications. Affected models include the RAX35, RAX38, RAX40, RAX120v1, and RAX120v2 running firmware below the patched versions; no public exploit code exists and no active exploitation has been confirmed. | MEDIUM | 4.6 | 0.0% | 23 |
|
| CVE-2026-0419 | OS command injection in NETGEAR JR6150 firmware (all versions ≤ 1.0.1.26) allows locally authenticated or WiFi-connected users to execute arbitrary operating system commands via insufficient input validation (CWE-20). The device reached End-of-Support in 2018 and NETGEAR will not release a patch, leaving all deployments permanently unmitigated. No public exploit code exists and active exploitation has not been confirmed (not listed in CISA KEV), but the perpetual absence of patching makes device replacement the only durable remediation. | MEDIUM | 4.4 | 0.1% | 22 |
No patch
|