Login Request a demo
Medium severity · published Aug 11, 2026
CVE-2026-11738
Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.
4.4
CVSS
0.4%
EPSS
No
On KEV
Description
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R7
R7000 · NETGEAR
0 · source: vendor
RA
RAXE500 · NETGEAR
before V1.2.14.114 · source: vendor
RS
RS700 · NETGEAR
before V1.0.7.66 · source: vendor
BF
Be9300 Firmware · Netgear
before 1.0.1.84 · source: NVD
MF
Mr60 Firmware · Netgear
before 1.1.8.142 · source: NVD
MF
Ms60 Firmware · Netgear
before 1.1.8.142 · source: NVD
RF
R6700ax Firmware · Netgear
before 1.0.18.164 · source: NVD
RF
Rax10 Firmware · Netgear
before 1.0.5.50 · source: NVD
RF
Rax120 Firmware · Netgear
before 1.2.10.56 · source: NVD
RF
Rax120v2 Firmware · Netgear
before 1.2.10.56 · source: NVD
RF
Rax20 Firmware · Netgear
before 1.0.17.142 · source: NVD
RF
Rax28 Firmware · Netgear
before 1.0.14.108 · source: NVD
Affected product
R7
R7000
NETGEAR
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11738
Vendor Advisory
https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory
Product
https://www.netgear.com/support/product/r7000/
Product
https://www.netgear.com/support/product/raxe500/
Product
https://www.netgear.com/support/product/rs700/
More from R7000
4.9
CVE-2026-11735
Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models
4.5
CVE-2026-9218
Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access
4.5
CVE-2026-9214
Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device.
4.5
CVE-2026-0417
Insufficient input validation in certain NETGEAR routers
4.5
CVE-2026-9210
Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router