CVE-2026-11732
Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models
- State
- Published
- Severity
- 6.3 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 16, 2026
- Reserved
- Jun 9, 2026
Description
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber | NETGEAR |
| 3.1 | 8.8 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NETGEAR |
Weaknesses
- CWE-20 Improper input validation
Affected Products
| Product | Versions |
|---|---|
CAX30NETGEAR |
|
RAX30NETGEAR |
|
RAX5NETGEAR |
|
RAXE300NETGEAR |
|
References
- https://www.netgear.com/support/product/cax30/productpatch
- https://www.netgear.com/support/product/rax5/productpatch
- https://www.netgear.com/support/product/rax30/productpatch
- https://www.netgear.com/support/product/raxe300/productpatch
- https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisoryvendor-advisorypatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.