CVE-2026-11738
published 2026-08-11CVE-2026-11738: Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make…
PriorityP422medium4.4CVSS 3.1
AVLACLPRHUINSUCNIHAN
EPSS
0.40%
34.3th percentile
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | be9300_firmware | < 1.0.1.84 | 1.0.1.84 |
| netgear | mr60_firmware | < 1.1.8.142 | 1.1.8.142 |
| netgear | ms60_firmware | < 1.1.8.142 | 1.1.8.142 |
| netgear | r6700ax_firmware | < 1.0.18.164 | 1.0.18.164 |
| netgear | r7000 | < * | * |
| netgear | rax10_firmware | < 1.0.5.50 | 1.0.5.50 |
| netgear | rax120_firmware | < 1.2.10.56 | 1.2.10.56 |
| netgear | rax120v2_firmware | < 1.2.10.56 | 1.2.10.56 |
| netgear | rax20_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear | rax28_firmware | < 1.0.14.108 | 1.0.14.108 |
| netgear | rax29_firmware | < 1.0.14.108 | 1.0.14.108 |
| netgear | rax30_firmware | < 1.0.14.108 | 1.0.14.108 |
| netgear | rax36s_firmware | < 1.0.5.50 | 1.0.5.50 |
| netgear | rax43_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear | rax45_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear | rax50_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear | rax70_firmware | < 1.0.19.172 | 1.0.19.172 |
| netgear | raxe500 | < V1.2.14.114 | V1.2.14.114 |
| netgear | rbr760_firmware | < 6.3.8.11 | 6.3.8.11 |
| netgear | rbs760_firmware | < 6.3.8.11 | 6.3.8.11 |
| netgear | rs100_firmware | < 1.0.1.80 | 1.0.1.80 |
| netgear | rs200_firmware | < 1.0.1.90 | 1.0.1.90 |
| netgear | rs280_firmware | < 1.0.1.90 | 1.0.1.90 |
| netgear | rs300_firmware | < 1.0.1.90 | 1.0.1.90 |
| netgear | rs500_firmware | < 1.0.1.90 | 1.0.1.90 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvdv4.04.3MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Amber
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
NETGEAR R7000/RAXE500/RS700 input validation
vuldb·2026-09-13·CVSS 4.4
CVE-2026-11738 [MEDIUM] NETGEAR R7000/RAXE500/RS700 input validation
A vulnerability labeled as very critical has been found in NETGEAR R7000, RAXE500 and RS700. The affected element is an unknown function. Executing a manipulation can lead to improper input validation.
The identification of this vulnerability is CVE-2026-11738. The attack may be launched remotely. There is no exploit available.
GHSA
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and fun
ghsa_unreviewed·2026-08-11
CVE-2026-11738 [MEDIUM] CWE-20 Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and fun
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-11
Published