CVE-2026-0408

published 2026-01-13

CVE-2026-0408: A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of…

medium 6.1 CVSS 4.0

AV A AC L AT N PR L UI N VC H VI H VA H SC N SI N SA N E U CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU N R U V D RE M U Amber

A path traversal vulnerability in NETGEAR WiFi range extenders allows
an attacker with LAN authentication to access the router's IP and
review the contents of the dynamically generated webproc file, which
records the username and password submitted to the router GUI.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
netgear	ex2800	< v1.0.1.82	v1.0.1.82
netgear	ex2800_firmware	< 1.0.1.82	1.0.1.82
netgear	ex3110	< v1.0.1.82	v1.0.1.82
netgear	ex3110_firmware	< 1.0.1.82	1.0.1.82
netgear	ex5000	< v1.0.1.82	v1.0.1.82
netgear	ex5000_firmware	< 1.0.1.82	1.0.1.82
netgear	ex6110	< v1.0.1.82	v1.0.1.82
netgear	ex6110_firmware	< 1.0.1.82	1.0.1.82

CWE-287