High severity · published Jun 9, 2026
CVE-2026-0419
Insufficient input validation vulnerability in NETGEAR JR6150
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no
further security updates are planned. NETGEAR strongly recommends
replacing these devices with newer NETGEAR models to ensure continued
security support and updates.
This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JR
JR6150 · NETGEAR
through 1.0.1.26 · source: vendor
JF
Jr6150 Firmware · Netgear
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0419
Vendor Advisory
https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
Product
https://www.netgear.com/support/product/jr6150
More from JR6150
4.5
CVE-2026-0412
Insufficient input validation vulnerability in NETGEAR JR6150 Web UI
