Medium severity · published Jun 9, 2026
CVE-2026-0416
Improper input validation in certain NETGEAR routers allows unauthorized modification of protected router functionality
4.5
CVSS
0.2%
EPSS
No
On KEV
Description
An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local network access to submit crafted input that bypasses intended management interface restrictions, resulting in unauthorized modification of protected router software or functionality.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
RAXE450 · NETGEAR
V1.0.12.96 before V1.2.14.114 · source: vendor
RA
RAXE500 · NETGEAR
V1.0.12.96 before V1.2.14.114 · source: vendor
RF
Raxe450 Firmware · Netgear
before 1.2.14.114 · source: NVD
RF
Raxe500 Firmware · Netgear
before 1.2.14.114 · source: NVD
Affected product
RA
RAXE450
NETGEAR
More from RAXE450
5.4
CVE-2026-62656
Post-authenticated command injection vulnerability found in certain NETGEAR RAX models
4.9
CVE-2026-11736
Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers
4.9
CVE-2026-11735
Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models
4.5
CVE-2026-0418
Certain NETGEAR devices allow administrators to tamper with system
4.5
CVE-2026-0417
Insufficient input validation in certain NETGEAR routers