An insufficient authentication vulnerability in NETGEAR WiFi range
extenders allows a network adjacent attacker with WiFi authentication or
a physical Ethernet port connection to bypass the authentication
process and access the admin panel.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0008.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
NETGEAR EX5000 unaffected
Version Status Constraints
0 affected < v1.0.1.82
NETGEAR EX3110 unaffected
Version Status Constraints
0 affected < v1.0.1.82
NETGEAR EX6110 unaffected
Version Status Constraints
0 affected < v1.0.1.82
NETGEAR EX2800 unaffected
Version Status Constraints
0 affected < v1.0.1.82

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Netgear Subscribe
Ex2800 Subscribe
Ex3110 Subscribe
Ex5000 Subscribe
Ex6110 Subscribe
Advisories

No advisories yet.

Fixes

Solution

Manually check the firmware version and update it to the latest. Fixed in: EX2800  firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex2800 EX3110  firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex3110 EX5000 firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex5000 EX6110  firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex6110

Workaround

No workaround given by the vendor.

References
Link Providers
https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory cve-icon cve-icon
https://www.netgear.com/support/product/ex2800 cve-icon cve-icon
https://www.netgear.com/support/product/ex3110 cve-icon cve-icon
https://www.netgear.com/support/product/ex5000 cve-icon cve-icon
https://www.netgear.com/support/product/ex6110 cve-icon cve-icon
History

Tue, 13 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Jan 2026 16:30:00 +0000

Type Values Removed Values Added
References

Tue, 13 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Description An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to bypass the authentication process and access the admin panel.
Title Authentication bypass in NETGEAR WiFi Range Extenders via network adjacent attacks
First Time appeared Netgear
Netgear ex2800
Netgear ex3110
Netgear ex5000
Netgear ex6110
Weaknesses CWE-287
CPEs cpe:2.3:h:netgear:ex2800:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ex3110:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ex5000:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ex6110:*:*:*:*:*:*:*:*
Vendors & Products Netgear
Netgear ex2800
Netgear ex3110
Netgear ex5000
Netgear ex6110
References
Metrics cvssV4_0

{'score': 6.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published:

Updated: 2026-01-14T04:57:23.822Z

Reserved: 2025-12-03T04:16:13.882Z

Link: CVE-2026-0407

cve-icon Vulnrichment

Updated: 2026-01-13T18:47:37.449Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-01-13T16:16:10.840

Modified: 2026-01-14T16:25:40.430

Link: CVE-2026-0407

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses