Description
Insufficient input validation vulnerability in the listed
NETGEAR models allows authenticated administrators connected to the
local network to make unauthorized modification to the device software and
functionality.
Published: 2026-08-11
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is caused by insufficient input validation in a set of NETGEAR Nighthawk routers, enabling a local administrator with network access to tamper with the device’s firmware and settings. This flaw compromises the integrity of the router and could allow the attacker to install malicious code, alter security controls, or redirect traffic. The weakness is characterized as an input validation error (CWE‑20).

Affected Systems

NETGEAR devices RAX20, RAX41, RAX41v2, RAX42, RAX42v2, RAX43, RAX43v2, RAX45, RAX49S, RAX50, RAX50v2, RAX54S, and RAX54Sv2 are affected. The fix is included in firmware versions RAX20 V1.0.18.144, RAX41/V1.1.6.36, RAX41v2 V1.1.6.36, RAX42 V1.1.6.36, RAX42v2 V1.1.6.36, RAX43 V1.1.6.36, RAX43v2 V1.1.6.36, RAX45 V1.0.17.142, RAX49S V1.1.6.36, RAX50 V1.1.6.36, RAX50v2 V1.1.6.36, RAX54S V1.1.6.36, and RAX54Sv2 V1.1.6.36. Devices marked End‑of‑Support cannot receive updates and should be retired.

Risk and Exploitability

The CVSS base score is 4.3, indicating a moderate impact. No EPSS score is provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits. The attack vector requires authenticated access on the local network, typically via the router’s administrative interface. An attacker who gains administrator privileges could modify firmware or configuration, but would need to bypass normal authentication mechanisms. Because the flaw is limited to admins, the risk is moderate and mainly depends on who has administrative rights.

Generated by OpenCVE AI on August 11, 2026 at 22:56 UTC.

Remediation

Vendor Solution

Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: ProductFixed VersionRAX20 (EoS) 4-Stream AX1800 WiFi 6 Router V1.0.18.144 https://www.netgear.com/support/product/rax20/ RAX41 (EoS) Nighthawk AX5 5-Stream AX3600 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax41/ RAX41v2 Nighthawk AX5 5-Stream AX3600 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax41v2/ RAX42 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax42/ RAX42v2 Nighthawk AX5 5-Stream AX4200 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax42v2/ RAX43 Nighthawk AX5 5-Stream AX4200 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax43/ RAX43v2 Nighthawk AX5 5-Stream AX4200 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax43v2/ RAX45 (EoS) Nighthawk AX6 6-Stream AX4300 WiFi Router V1.0.17.142 https://www.netgear.com/support/product/rax45/ RAX49S Nighthawk AX6 6-Stream AX5300 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax49s/ RAX50 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router V1.1.6.36 https://www.netgear.com/support/product/rax50/ RAX50v2 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router V1.1.6.36 https://www.netgear.com/support/product/rax50v2/ RAX54S Nighthawk AX6 6-Stream AX5400 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax54s/ RAX54Sv2 Nighthawk AX6 6-Stream AX5400 WiFi Router V1.1.6.36 https://www.netgear.com/support/product/rax54sv2/ Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.

OpenCVE Recommended Actions

  • Update the firmware to the latest version that includes the fix (e.g., RAX20 V1.0.18.144 or other relevant V1.1.6.36 releases).
  • Retire any End‑of‑Support devices and replace them with newer NETGEAR models that receive ongoing security updates.
  • Restrict local administrator access to trusted personnel and monitor the router’s configuration for unauthorized changes.

Generated by OpenCVE AI on August 11, 2026 at 22:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
References

Tue, 11 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Netgear
Netgear rax20
Netgear rax41
Netgear rax41v2
Netgear rax42
Netgear rax42v2
Netgear rax43
Netgear rax43v2
Netgear rax45
Netgear rax49s
Netgear rax50
Netgear rax50v2
Netgear rax54s
Netgear rax54sv2
Vendors & Products Netgear
Netgear rax20
Netgear rax41
Netgear rax41v2
Netgear rax42
Netgear rax42v2
Netgear rax43
Netgear rax43v2
Netgear rax45
Netgear rax49s
Netgear rax50
Netgear rax50v2
Netgear rax54s
Netgear rax54sv2

Tue, 11 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.
Title Some NETGEAR Nighthawk devices allow administrators to tamper with the device
Weaknesses CWE-20
References
Metrics cvssV4_0

{'score': 4.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber'}
cve-icon MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published:

Updated: 2026-08-12T07:39:19.719Z

Reserved: 2026-06-09T02:46:46.338Z

Link: CVE-2026-11737

cve-icon Vulnrichment

Updated: 2026-08-11T19:43:08.170Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T16:17:27.917

Modified: 2026-08-28T21:16:15.740

Link: CVE-2026-11737

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T23:15:12Z

Weaknesses
  • CWE-20

    Improper Input Validation