NETGEAR Extender: Session ID Predictability Allows Admin Hijack
CVE-2026-11730 Published on October 13, 2026
Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Vulnerability Analysis
Attack Vector:
ADJACENT
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Weakness Type
What is a PRNG Vulnerability?
The software uses a Pseudo-Random Number Generator (PRNG) that does not correctly manage seeds.
CVE-2026-11730 has been classified to as a PRNG vulnerability or weakness.
Affected Versions
NETGEAR EX3700:- Before V1.0.0.102 is affected.
- Before V1.0.1.74 is affected.