CVE-2026-3088

Unauthenticated users can disrupt router operation

State: Published
Severity: 4.9 Medium
Published: Jun 9, 2026
Updated: Jun 10, 2026
Reserved: Feb 24, 2026

Description

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.

Scores

CVSS	Score	Vector	Source
4.0	4.9 Medium	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber	NETGEAR

Weaknesses

CWE-787 Out-of-bounds write

Affected Products

Product	Versions
RBR860NETGEAR	V6.3.7.10 to before V7.2.7.15Affected
RBRE950NETGEAR	before v7.2.7.15Affected
RBRE960NETGEAR	V6.3.7.10 to before V7.2.7.15Affected
RBE970NETGEAR	V6.3.7.10 to before V9.10.1.4Affected
RBE971NETGEAR	V6.3.7.10 to before V9.10.1.4Affected
RBS860NETGEAR	before V7.2.7.15Affected
RBSE950NETGEAR	before v7.2.7.15Affected
RBSE960NETGEAR	before V7.2.7.15Affected

References

https://www.netgear.com/support/product/rbr860/productpatch
https://www.netgear.com/support/product/rbre950/productpatch
https://www.netgear.com/support/product/rbre960/productpatch
https://www.netgear.com/support/product/rbs860/productpatch
https://www.netgear.com/support/product/rbse960/productpatch
https://www.netgear.com/support/product/rbse950/productpatch
https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisoryvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.