Description
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Published: 2026-10-13
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Session hijacking of administrator portal
Action: Update Firmware
AI Analysis

Impact

Insufficient session randomness in certain NETGEAR EX Series Wi‑Fi extenders allows a local attacker to predict valid session identifiers and hijack an authenticated administrator session on the device’s web management portal, thereby compromising the administrative interface.

Affected Systems

NETGEAR EX3700 and EX6120 Wi‑Fi range extenders are affected. Devices running firmware versions lower than V1.0.0.102 on the EX3700 or lower than V1.0.1.74 on the EX6120 contain the flaw. The EX3700 model has reached end‑of‑support and will no longer receive security updates, whereas the EX6120 remains supported. Devices with automatic updates enabled may already have the patch applied. The fixed firmware versions are EX3700 V1.0.0.102 and EX6120 V1.0.1.74.

Risk and Exploitability

The CVSS score of 2.1 classifies the issue as low severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of exploitation. The likely attack vector is local network access: an attacker who can reach the Wi‑Fi network, such as one who has valid credentials, can predict the session token with trivial effort. The impact remains confined to the local network and can be mitigated by rapid firmware upgrade or by removing unsupported devices.

Generated by OpenCVE AI on October 13, 2026 at 20:04 UTC.

Remediation

Vendor Solution

Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: ProductFixed VersionEX3700 (EoS) AC750 WiFi Range Extender Essentials Edition V1.0.0.102 https://www.netgear.com/support/product/ex3700 EX6120 AC1200 Dual Band WiFi Range Extender V1.0.1.74 https://www.netgear.com/support/product/ex6120 Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.

OpenCVE Recommended Actions

  • Update the device to the latest firmware releases: EX3700 V1.0.0.102 and EX6120 V1.0.1.74.
  • Restrict administrative access by limiting the web management interface to the local network or a secure VLAN and enforce strong, unique passwords for administrator accounts.
  • If the device has reached end‑of‑support or cannot be updated, remove it from the production network or replace it with a supported model to maintain security.

Generated by OpenCVE AI on October 13, 2026 at 20:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
References

Tue, 13 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Netgear
Netgear ex3700
Netgear ex6120
Vendors & Products Netgear
Netgear ex3700
Netgear ex6120

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 4.5, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber'}

Tue, 13 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Title Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models
Weaknesses CWE-335
References
Metrics cvssV4_0

{'score': 4.5, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber'}

Subscriptions

Netgear Ex3700 Ex6120
cve-icon MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published:

Updated: 2026-10-19T19:02:53.835Z

Reserved: 2026-06-09T02:46:38.130Z

Link: CVE-2026-11730

cve-icon Vulnrichment

Updated: 2026-10-19T19:02:47.530Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T15:17:43.340

Modified: 2026-10-19T20:17:55.943

Link: CVE-2026-11730

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T20:15:14Z

Weaknesses
  • CWE-335

    Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)