CVE-2026-11739

published 2026-08-11

CVE-2026-11739: A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify…

Priority P4 33 medium 4.9 CVSS 4.0

AV A AC H AT P PR N UI N VC H VI H VA N SC N SI N SA N E U CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU N R U V D RE L U Amber

A command injection vulnerability in certain affected NETGEAR Nighthawk
devices allows a network-adjacent attacker with the ability to intercept
and modify local network traffic (attacker in the middle) to compromise
the confidentiality and integrity of the affected device.

Affected

27 ranges · showing 25

Vendor	Product	Version range	Fixed in
netgear	mr60	< V1.1.8.142	V1.1.8.142
netgear	mr70	< V1.0.4.48	V1.0.4.48
netgear	mr90	< V1.0.2.46	V1.0.2.46
netgear	ms60	< V1.1.8.142	V1.1.8.142
netgear	ms70	< V1.0.4.48	V1.0.4.48
netgear	ms90	< V1.0.2.46	V1.0.2.46
netgear	rax20	< V1.0.17.142	V1.0.17.142
netgear	rax200	< V1.0.11.148	V1.0.11.148
netgear	rax35	< V1.0.17.142	V1.0.17.142
netgear	rax35v2	< V1.0.17.142	V1.0.17.142
netgear	rax41	< V1.1.6.36	V1.1.6.36
netgear	rax41v2	< V1.1.6.36	V1.1.6.36
netgear	rax42	< V1.1.6.36	V1.1.6.36
netgear	rax42v2	< V1.1.6.36	V1.1.6.36
netgear	rax43	< V1.1.6.36	V1.1.6.36
netgear	rax43v2	< V1.1.6.36	V1.1.6.36
netgear	rax45	< V1.0.17.142	V1.0.17.142
netgear	rax49s	< V1.1.6.36	V1.1.6.36
netgear	rax50	< V1.1.6.36	V1.1.6.36
netgear	rax50v2	< V1.1.6.36	V1.1.6.36
netgear	rax54s	< V1.1.6.36	V1.1.6.36
netgear	rax54sv2	< V1.1.6.36	V1.1.6.36
netgear	rax80	< V1.0.11.148	V1.0.11.148
netgear	raxe500	< V1.2.14.110	V1.2.14.110
netgear	rs700	< V1.0.9.6	V1.0.9.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78