NETGEAR Router Auth Priv Esc via Input Validation
CVE-2026-11737 Published on August 11, 2026

Some NETGEAR Nighthawk devices allow administrators to tamper with the device
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:

ADJACENT

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

NONE

Weakness Type

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Products Associated with CVE-2026-11737

Want to know whenever a new CVE is published for Netgear products? stack.watch will email you.

Netgear Rax20

Netgear Rax41

Netgear Rax41v2

Netgear Rax42

Netgear Rax42v2

Netgear Rax43

Netgear Rax43v2

Netgear Rax45

Netgear Rax49s

Netgear Rax50

Netgear Rax50v2

Netgear Rax54sv2

Affected Versions

NETGEAR RAX20:

Before V1.0.18.144 is affected.

NETGEAR RAX41:

Before V1.1.6.36 is affected.

NETGEAR RAX41v2:

Before V1.1.6.36 is affected.

NETGEAR RAX42:

Before V1.1.6.36 is affected.

NETGEAR RAX42v2:

Before V1.1.6.36 is affected.

NETGEAR RAX43:

Before V1.1.6.36 is affected.

NETGEAR RAX43v2:

Before V1.1.6.36 is affected.

NETGEAR RAX45:

Before V1.0.17.142 is affected.

NETGEAR RAX49S:

Before V1.1.6.36 is affected.

NETGEAR RAX50:

Before V1.1.6.36 is affected.

NETGEAR RAX50v2:

Before V1.1.6.36 is affected.

NETGEAR RAX54S:

Before V1.1.6.36 is affected.

NETGEAR RAX54Sv2:

Before V1.1.6.36 is affected.

Exploit Probability

EPSS

0.22%

Percentile

11.40%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.