CVE-2026-0408
6.1
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Summary
A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically generated webproc file, which records the username and password submitted to the router GUI.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NETGEAR | EX5000 | 0 < v1.0.1.82 | affected |
| NETGEAR | EX3110 | 0 < v1.0.1.82 | affected |
| NETGEAR | EX6110 | 0 < v1.0.1.82 | affected |
| NETGEAR | EX2800 | 0 < v1.0.1.82 | affected |
Weaknesses
- CWE-287: CWE-287 Improper Authentication
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://www.netgear.com/support/product/ex5000
- https://www.netgear.com/support/product/ex3110
- https://www.netgear.com/support/product/ex6110
- https://www.netgear.com/support/product/ex2800
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.