CVE-2026-0408

CWE-287 — Improper Authentication3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.1%
top 80.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Netgear Ex2800Netgear Ex3110Netgear Ex5000+5 more
Timeline
PublishedJan 13

Description

A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically generated webproc file, which records the username and password submitted to the router GUI.

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages8 packages

▶CVEListV5netgear/ex2800< v1.0.1.82
▶CVEListV5netgear/ex3110< v1.0.1.82
▶CVEListV5netgear/ex5000< v1.0.1.82
▶CVEListV5netgear/ex6110< v1.0.1.82
▶NVDnetgear/ex2800_firmware< 1.0.1.82

Patches

Patch: kb.netgear.com ↗Patch: www.netgear.com ↗Patch: www.netgear.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rhrj-763h-99fq: A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the con↗2026-01-13
▶
CVEList
Path traversal vulnerability in Netgear WiFi Range Extenders↗2026-01-13
▶