Medium severity · published Jun 9, 2026
CVE-2026-0412
Insufficient input validation vulnerability in NETGEAR JR6150 Web UI
4.5
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows administrators connected to the local network to make unauthorized modification of router software and functionality. NETGEAR JR6150 reached End-of-Support status in 2018 and is no longer receiving security updates. NETGEAR strongly recommends
replacing these devices with newer NETGEAR models to ensure continued
security support and updates.
This vulnerability has been identified through firmware emulation in a
controlled research environment and has not been verified on production
hardware.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JR
JR6150 · NETGEAR
0 · source: vendor
JF
Jr6150 Firmware · Netgear
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0412
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0412
Vendor Advisory
https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
Product
https://www.netgear.com/support/product/jr6150
More from JR6150
8.0
CVE-2026-0419
Insufficient input validation vulnerability in NETGEAR JR6150
