CVE Feed

    Dashboard / CVE / CVE-2026-11739

    CVE-2026-11739

    A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

    Published:Aug 11, 2026
    Last Modified:Sep 9, 2026
    EPS:Aug 11, 2026
    EPSS Score:0.01053
    CVSS Score:6.4

    Affected Products

    Vendor
    Netgear
    Product
    Mr60
    Vendor
    Netgear
    Product
    Mr60 Firmware
    Vendor
    Netgear
    Product
    Mr70
    Vendor
    Netgear
    Product
    Mr70 Firmware
    Vendor
    Netgear
    Product
    Mr90
    Vendor
    Netgear
    Product
    Mr90 Firmware
    Vendor
    Netgear
    Product
    Ms60
    Vendor
    Netgear
    Product
    Ms60 Firmware
    Vendor
    Netgear
    Product
    Ms70
    Vendor
    Netgear
    Product
    Ms70 Firmware
    Vendor
    Netgear
    Product
    Ms90
    Vendor
    Netgear
    Product
    Ms90 Firmware
    Vendor
    Netgear
    Product
    Rax20
    Vendor
    Netgear
    Product
    Rax200
    Vendor
    Netgear
    Product
    Rax200 Firmware
    Vendor
    Netgear
    Product
    Rax20 Firmware
    Vendor
    Netgear
    Product
    Rax35
    Vendor
    Netgear
    Product
    Rax35 Firmware
    Vendor
    Netgear
    Product
    Rax35v2
    Vendor
    Netgear
    Product
    Rax35v2 Firmware
    Vendor
    Netgear
    Product
    Rax41
    Vendor
    Netgear
    Product
    Rax41 Firmware
    Vendor
    Netgear
    Product
    Rax41v2
    Vendor
    Netgear
    Product
    Rax41v2 Firmware
    Vendor
    Netgear
    Product
    Rax42
    Vendor
    Netgear
    Product
    Rax42 Firmware
    Vendor
    Netgear
    Product
    Rax42v2
    Vendor
    Netgear
    Product
    Rax42v2 Firmware
    Vendor
    Netgear
    Product
    Rax43
    Vendor
    Netgear
    Product
    Rax43 Firmware
    Vendor
    Netgear
    Product
    Rax43v2
    Vendor
    Netgear
    Product
    Rax43v2 Firmware
    Vendor
    Netgear
    Product
    Rax45
    Vendor
    Netgear
    Product
    Rax45 Firmware
    Vendor
    Netgear
    Product
    Rax49s
    Vendor
    Netgear
    Product
    Rax49s Firmware
    Vendor
    Netgear
    Product
    Rax50
    Vendor
    Netgear
    Product
    Rax50 Firmware
    Vendor
    Netgear
    Product
    Rax50v2
    Vendor
    Netgear
    Product
    Rax50v2 Firmware
    Vendor
    Netgear
    Product
    Rax54s
    Vendor
    Netgear
    Product
    Rax54s Firmware
    Vendor
    Netgear
    Product
    Rax54sv2
    Vendor
    Netgear
    Product
    Rax54sv2 Firmware
    Vendor
    Netgear
    Product
    Rax80
    Vendor
    Netgear
    Product
    Rax80 Firmware
    Vendor
    Netgear
    Product
    Raxe500
    Vendor
    Netgear
    Product
    Raxe500 Firmware
    Vendor
    Netgear
    Product
    Rs700
    Vendor
    Netgear
    Product
    Rs700 Firmware
    Vendor
    Netgear
    Product
    Xr1000
    Vendor
    Netgear
    Product
    Xr1000 Firmware
    Vendor
    Netgear
    Product
    Xr1000v2
    Vendor
    Netgear
    Product
    Xr1000v2 Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-11738 (CVSS 4.3) — Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators c…
    CVE-2026-11814 (CVSS 4.9) — A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the abi…
    CVE-2026-0418 (CVSS 4.3) — Insufficient configuration management in the listed devices allows authenticated administrators connected to t…
    CVE-2026-0417 (CVSS 4.3) — Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators …
    CVE-2026-9210 (CVSS 4.9) — Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators c…
    CVE-2021-34983 (CVSS 6.5) — NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerabili…
    CVE-2021-34982 (CVSS 8.8) — NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabi…
    CVE-2023-36187 (CVSS 9.8) — Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attac…
    CVE-2022-27647 (CVSS 8) — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NE…
    CVE-2022-27642 (CVSS 8.8) — This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NET…

    References

    https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory
    https://www.netgear.com/support/product/mr60/
    https://www.netgear.com/support/product/mr70/
    https://www.netgear.com/support/product/mr90/
    https://www.netgear.com/support/product/ms60/
    https://www.netgear.com/support/product/ms70/
    https://www.netgear.com/support/product/ms90/
    https://www.netgear.com/support/product/rax20/
    https://www.netgear.com/support/product/rax200/
    https://www.netgear.com/support/product/rax35/
    https://www.netgear.com/support/product/rax35v2/
    https://www.netgear.com/support/product/rax41/
    https://www.netgear.com/support/product/rax41v2/
    https://www.netgear.com/support/product/rax42/
    https://www.netgear.com/support/product/rax42v2/
    https://www.netgear.com/support/product/rax43/
    https://www.netgear.com/support/product/rax43v2/
    https://www.netgear.com/support/product/rax45/
    https://www.netgear.com/support/product/rax49s/
    https://www.netgear.com/support/product/rax50/
    https://www.netgear.com/support/product/rax50v2/
    https://www.netgear.com/support/product/rax80/
    https://www.netgear.com/support/product/raxe500/
    https://www.netgear.com/support/product/rs700/
    https://www.netgear.com/support/product/xr1000/
    https://www.netgear.com/support/product/xr1000v2/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High