Riskcovery

CVE-2026-11739

Command injection vulnerability in some NETGEAR Nighthawk devices

State
Published
Severity
4.9 Medium
Published
Aug 11, 2026
Updated
Aug 12, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Scores

CVSSScoreVectorSource
4.04.9 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:AmberNETGEAR

Weaknesses

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

ProductVersions
MR60NETGEAR
  • before V1.1.8.142Affected
MR70NETGEAR
  • before V1.0.4.48Affected
MR90NETGEAR
  • before V1.0.2.46Affected
MS60NETGEAR
  • before V1.1.8.142Affected
MS70NETGEAR
  • before V1.0.4.48Affected
MS90NETGEAR
  • before V1.0.2.46Affected
RAX20NETGEAR
  • before V1.0.17.142Affected
RAX200NETGEAR
  • before V1.0.11.148Affected
RAX35NETGEAR
  • before V1.0.17.142Affected
RAX35v2NETGEAR
  • before V1.0.17.142Affected
RAX41NETGEAR
  • before V1.1.6.36Affected
RAX41v2NETGEAR
  • before V1.1.6.36Affected
RAX42NETGEAR
  • before V1.1.6.36Affected
RAX42v2NETGEAR
  • before V1.1.6.36Affected
RAX43NETGEAR
  • before V1.1.6.36Affected
RAX43v2NETGEAR
  • before V1.1.6.36Affected
RAX45NETGEAR
  • before V1.0.17.142Affected
RAX49SNETGEAR
  • before V1.1.6.36Affected
RAX50NETGEAR
  • before V1.1.6.36Affected
RAX50v2NETGEAR
  • before V1.1.6.36Affected
RAX54SNETGEAR
  • before V1.1.6.36Affected
RAX54Sv2NETGEAR
  • before V1.1.6.36Affected
RAX80NETGEAR
  • before V1.0.11.148Affected
RAXE500NETGEAR
  • before V1.2.14.110Affected
RS700NETGEAR
  • before V1.0.9.6Affected
XR1000NETGEAR
  • before V1.1.0.22Affected
XR1000v2NETGEAR
  • before V1.1.0.22Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.