CVE-2026-0418: Certain NETGEAR devices allow administrators to tamper with system

Description

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack vector

Adjacent

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 16% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CB

CBR750 · NETGEAR

before v4.6.14.4 · source: vendor

EX

EX6120 · NETGEAR

through 1.0.0.72 · source: vendor

EX

EX6130 · NETGEAR

through 1.0.0.54 · source: vendor

MR

MR60 · NETGEAR

before V1.1.7.128 · source: vendor

MR

MR70 · NETGEAR

before V1.0.3.28 · source: vendor

MR

MR80 · NETGEAR

before V1.1.7.6 · source: vendor

MS

MS60 · NETGEAR

before V1.1.7.128 · source: vendor

MS

MS70 · NETGEAR

before V1.0.3.28 · source: vendor

MS

MS80 · NETGEAR

before V1.1.7.6 · source: vendor

RA

RAX15 · NETGEAR

through 1.0.18.144 · source: vendor

RA

RAX20 · NETGEAR

through 1.0.18.144 · source: vendor

RA

RAX200 · NETGEAR

through 1.0.11.148 · source: vendor