netgear rax20 CVE-2026-11739 vulnerability in Netgear Products
Published on August 11, 2026

Command injection vulnerability in some NETGEAR Nighthawk devices
A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2026-11739 has been classified to as a Shell injection vulnerability or weakness.


Products Associated with CVE-2026-11739

Want to know whenever a new CVE is published for Netgear products? stack.watch will email you.

Netgear Rax20
 
Netgear Rax35v2
 
Netgear Rax41
 
Netgear Rax41v2
 
Netgear Rax42
 
Netgear Rax42v2
 
Netgear Rax43
 
Netgear Rax43v2
 
Netgear Rax45
 
Netgear Rax49s
 
Netgear Rax50
 
Netgear Rax50v2
 
Netgear Rax54sv2
 
Netgear Raxe500
 
Netgear Rs700
 
Netgear Xr1000
 
Netgear Xr1000v2
 

Affected Versions

NETGEAR MR60: NETGEAR MR70: NETGEAR MR90: NETGEAR MS60: NETGEAR MS70: NETGEAR MS90: NETGEAR RAX20: NETGEAR RAX200: NETGEAR RAX35: NETGEAR RAX35v2: NETGEAR RAX41: NETGEAR RAX41v2: NETGEAR RAX42: NETGEAR RAX42v2: NETGEAR RAX43: NETGEAR RAX43v2: NETGEAR RAX45: NETGEAR RAX49S: NETGEAR RAX50: NETGEAR RAX50v2: NETGEAR RAX54S: NETGEAR RAX54Sv2: NETGEAR RAX80: NETGEAR RAXE500: NETGEAR RS700: NETGEAR XR1000: NETGEAR XR1000v2: