CVE-2026-11814
EUVD-2026-5618811.08.2026, 16:17
A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| netgear | be9300_firmware | 𝑥 < 1.0.1.84 |
| netgear | mr60_firmware | 𝑥 < 1.1.8.142 |
| netgear | ms60_firmware | 𝑥 < 1.1.8.142 |
| netgear | r6700ax_firmware | 𝑥 < 1.0.18.164 |
| netgear | rax10_firmware | 𝑥 < 1.0.5.50 |
| netgear | rax120_firmware | 𝑥 < 1.2.10.56 |
| netgear | rax120v2_firmware | 𝑥 < 1.2.10.56 |
| netgear | rax20_firmware | 𝑥 < 1.0.17.142 |
| netgear | rax28_firmware | 𝑥 < 1.0.14.108 |
| netgear | rax29_firmware | 𝑥 < 1.0.14.108 |
| netgear | rax30_firmware | 𝑥 < 1.0.14.108 |
| netgear | rax36s_firmware | 𝑥 < 1.0.5.50 |
| netgear | rax43_firmware | 𝑥 < 1.0.17.142 |
| netgear | rax45_firmware | 𝑥 < 1.0.17.142 |
| netgear | rax50_firmware | 𝑥 < 1.0.17.142 |
| netgear | rax70_firmware | 𝑥 < 1.0.19.172 |
| netgear | rbr760_firmware | 𝑥 < 6.3.8.11 |
| netgear | rbs760_firmware | 𝑥 < 6.3.8.11 |
| netgear | rs100_firmware | 𝑥 < 1.0.1.80 |
| netgear | rs200_firmware | 𝑥 < 1.0.1.90 |
| netgear | rs280_firmware | 𝑥 < 1.0.1.90 |
| netgear | rs300_firmware | 𝑥 < 1.0.1.90 |
| netgear | rs500_firmware | 𝑥 < 1.0.1.90 |
| netgear | rs600_firmware | 𝑥 < 1.0.1.90 |
| netgear | rs70_firmware | 𝑥 < 1.0.1.80 |
| netgear | rs90_firmware | 𝑥 < 1.0.1.80 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-295 - Improper Certificate ValidationThe software does not validate, or incorrectly validates, a certificate.
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
References