Medium severity · published Jul 14, 2026
CVE-2026-62656
Post-authenticated command injection vulnerability found in certain NETGEAR RAX models
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A
security flaw was found in certain NETGEAR RAX models that could allow
a logged-in user to send specially crafted requests to the router and run
unauthorized commands. This could enable the user to make unauthorized changes
to the router and affect its security and operation.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
RAXE450 · NETGEAR
before V1.2.14.114 · source: vendor
RA
RAXE500 · NETGEAR
before V1.2.14.114 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62656
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62656
kb.netgear.com
https://kb.netgear.com/000070859/July-2026-NETGEAR-Security-Advisory
www.netgear.com
https://www.netgear.com/support/product/raxe450/
www.netgear.com
https://www.netgear.com/support/product/raxe500/
More from RAXE450
4.9
CVE-2026-11736
Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers
4.9
CVE-2026-11735
Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models
4.5
CVE-2026-0418
Certain NETGEAR devices allow administrators to tamper with system
4.5
CVE-2026-0417
Insufficient input validation in certain NETGEAR routers
4.5
CVE-2026-9210
Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router