Riskcovery

CVE-2026-0418

Certain NETGEAR devices allow administrators to tamper with system

State
Published
Severity
4.3 Medium
Published
Jun 9, 2026
Updated
Jun 10, 2026
Reserved
Dec 3, 2025

Read the record on cve.org

Description

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

Scores

CVSSScoreVectorSource
4.04.3 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/R:U/V:D/RE:L/U:AmberNETGEAR

Weaknesses

  • CWE-15 External control of system or configuration setting

Affected Products

ProductVersions
CBR750NETGEAR
  • before v4.6.14.4Affected
EX6120NETGEAR
  • 1.0.0.72 and earlierAffected
EX6130NETGEAR
  • 1.0.0.54 and earlierAffected
MR60NETGEAR
  • before V1.1.7.128Affected
MR70NETGEAR
  • before V1.0.3.28Affected
MR80NETGEAR
  • before V1.1.7.6Affected
MS60NETGEAR
  • before V1.1.7.128Affected
MS70NETGEAR
  • before V1.0.3.28Affected
MS80NETGEAR
  • before V1.1.7.6Affected
RAX15NETGEAR
  • 1.0.18.144 and earlierAffected
RAX20NETGEAR
  • 1.0.18.144 and earlierAffected
RAX200NETGEAR
  • 1.0.11.148 and earlierAffected
RAX35v2NETGEAR
  • before V1.0.11.112Affected
RAX38v2NETGEAR
  • before V1.0.11.112Affected
RAX40v2NETGEAR
  • before V1.0.11.112Affected
RAX42NETGEAR
  • before V1.0.11.112Affected
RAX43NETGEAR
  • before V1.0.11.112Affected
RAX45NETGEAR
  • before V1.0.11.112Affected
RAX48NETGEAR
  • before V1.0.11.112Affected
RAX50NETGEAR
  • before V1.0.11.112Affected
RAX50SNETGEAR
  • before V1.0.11.112Affected
RAX75NETGEAR
  • 1.0.11.148 and earlierAffected
RAX80NETGEAR
  • 1.0.11.148 and earlierAffected
RAXE450NETGEAR
  • before V1.0.10.86Affected
RAXE500NETGEAR
  • before V1.0.10.86Affected
RBR750NETGEAR
  • before V4.6.14.3Affected
RBR840NETGEAR
  • before V4.6.14.3Affected
RBR850NETGEAR
  • before V4.6.14.3Affected
RBRE960NETGEAR
  • before V6.3.7.5Affected
RBS750NETGEAR
  • before V4.6.14.3Affected
RBS840NETGEAR
  • before V4.6.14.3Affected
RBS850NETGEAR
  • before V4.6.14.3Affected
RBSE960NETGEAR
  • before V6.3.7.5Affected
RS700NETGEAR
  • before V1.0.7.66Affected
XR1000NETGEAR
  • before v1.0.0.68Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.