Medium severity · published Oct 13, 2026
CVE-2026-107918
Insufficient input validation vulnerability in NETGEAR R7300
4.5
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R7
R7300DST · NETGEAR
through V1 1.0.0.74 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107918
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107918
product
https://www.netgear.com/support/product/r7300dst
vendor-advisory
https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory
More from R7300DST
4.5
CVE-2026-107917
Insufficient input validation vulnerability in NETGEAR R7300 router