CVE-2026-11737

Some NETGEAR Nighthawk devices allow administrators to tamper with the device

State: Published
Severity: 4.3 Medium
Published: Aug 11, 2026
Updated: Aug 12, 2026
Reserved: Jun 9, 2026

Description

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.

Scores

CVSS	Score	Vector	Source
4.0	4.3 Medium	CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber	NETGEAR

Weaknesses

CWE-20 Improper input validation

Affected Products

Product	Versions
RAX20NETGEAR	before V1.0.18.144Affected
RAX41NETGEAR	before V1.1.6.36Affected
RAX41v2NETGEAR	before V1.1.6.36Affected
RAX42NETGEAR	before V1.1.6.36Affected
RAX42v2NETGEAR	before V1.1.6.36Affected
RAX43NETGEAR	before V1.1.6.36Affected
RAX43v2NETGEAR	before V1.1.6.36Affected
RAX45NETGEAR	before V1.0.17.142Affected
RAX49SNETGEAR	before V1.1.6.36Affected
RAX50NETGEAR	before V1.1.6.36Affected
RAX50v2NETGEAR	before V1.1.6.36Affected
RAX54SNETGEAR	before V1.1.6.36Affected
RAX54Sv2NETGEAR	before V1.1.6.36Affected

References

https://www.netgear.com/support/product/rax20/productpatch
https://www.netgear.com/support/product/rax42/productpatch
https://www.netgear.com/support/product/rax41v2/productpatch
https://www.netgear.com/support/product/rax42v2/productpatch
https://www.netgear.com/support/product/rax41/productpatch
https://www.netgear.com/support/product/rax43/productpatch
https://www.netgear.com/support/product/rax45/productpatch
https://www.netgear.com/support/product/rax49s/productpatch
https://www.netgear.com/support/product/rax50/productpatch
https://www.netgear.com/support/product/rax43v2/productpatch
https://www.netgear.com/support/product/rax50v2/productpatch
https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisoryvendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.