CVE-2026-11739

Summary

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Affected Software

VendorProductVersion RangeStatus
NETGEARMR600 < V1.1.8.142affected
NETGEARMR700 < V1.0.4.48affected
NETGEARMR900 < V1.0.2.46affected
NETGEARMS600 < V1.1.8.142affected
NETGEARMS700 < V1.0.4.48affected
NETGEARMS900 < V1.0.2.46affected
NETGEARRAX200 < V1.0.17.142affected
NETGEARRAX2000 < V1.0.11.148affected
NETGEARRAX350 < V1.0.17.142affected
NETGEARRAX35v20 < V1.0.17.142affected
NETGEARRAX410 < V1.1.6.36affected
NETGEARRAX41v20 < V1.1.6.36affected
NETGEARRAX420 < V1.1.6.36affected
NETGEARRAX42v20 < V1.1.6.36affected
NETGEARRAX430 < V1.1.6.36affected
NETGEARRAX43v20 < V1.1.6.36affected
NETGEARRAX450 < V1.0.17.142affected
NETGEARRAX49S0 < V1.1.6.36affected
NETGEARRAX500 < V1.1.6.36affected
NETGEARRAX50v20 < V1.1.6.36affected
NETGEARRAX54S0 < V1.1.6.36affected
NETGEARRAX54Sv20 < V1.1.6.36affected
NETGEARRAX800 < V1.0.11.148affected
NETGEARRAXE5000 < V1.2.14.110affected
NETGEARRS7000 < V1.0.9.6affected
NETGEARXR10000 < V1.1.0.22affected
NETGEARXR1000v20 < V1.1.0.22affected

Weaknesses

  • CWE-78: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References