CVE-2026-11738
Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.
CVE-2026-11738 is a medium vulnerability (CVSS 4.3) in Netgear Be9300 Firmware, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 4.0, CVE List
- Exploit chance
- 0.40%EPSS, 35th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
- netgear be9300 firmware
- netgear mr60 firmware
- netgear ms60 firmware
- netgear r6700ax firmware
- netgear r7000
- netgear rax10 firmware
- netgear rax120 firmware
- netgear rax120v2 firmware
- netgear rax20 firmware
- netgear rax28 firmware
- netgear rax29 firmware
- netgear rax30 firmware
Show 17 moreShow less
- netgear rax36s firmware
- netgear rax43 firmware
- netgear rax45 firmware
- netgear rax50 firmware
- netgear rax70 firmware
- netgear raxe500
- netgear rbr760 firmware
- netgear rbs760 firmware
- netgear rs100 firmware
- netgear rs200 firmware
- netgear rs280 firmware
- netgear rs300 firmware
- netgear rs500 firmware
- netgear rs600 firmware
- netgear rs700
- netgear rs70 firmware
- netgear rs90 firmware
What each source reports
CVE List Score used
Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
- Record
CVE-2026-11738- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-56193
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
- Record
EUVD-2026-56193- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vq25-x3jw-cmr7
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated...
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
- Record
GHSA-vq25-x3jw-cmr7- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
- Record
CVE-2026-11738- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.