NETGEAR Security Advisories & CVEs
8 advisories tracked · NETGEAR Security Advisories (kb.netgear.com) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor NETGEAR CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your NETGEAR device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in NETGEAR's recent advisories.
Official source
NETGEAR Security Advisories (kb.netgear.com) via NVD
NETGEAR publishes official Security Advisories on kb.netgear.com, but the KB has no machine-readable feed and NETGEAR CVEs are assigned by a mix of NETGEAR's PSIRT and third-party researchers — so VulniPulse ingests them from NVD (keyword-filtered to NETGEAR, requiring a NETGEAR product in the description) and links each CVE back to its kb.netgear.com advisory when referenced. Covers the Orbi and Nighthawk router / WiFi lines, ReadyNAS, ProSAFE / Insight-managed switches and the cable-modem gateways — an enormous internet-facing SOHO and prosumer fleet that routinely ships remotely exploitable router bugs.
Latest NETGEAR advisories
Low [CVE-2026-11730] Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal. Affected products named by the advisory: EX3700; EX6120.
Low [CVE-2026-9216] insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI
An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network. Affected products named by the advisory: RAX30; RAX35; RAX38; RAX40; and 1 more. Affected products named by the advisory: RAXE300.
Low [CVE-2026-9215] cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator
A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability. Affected products named by the advisory: XR1000v2; XR500.
Low [CVE-2026-11736] stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality
A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality. Affected products named by the advisory: RAX20; RAX35v2; RAX41; RAX41v2; and 4 more. Affected products named by the advisory: RAX42; RAX42v2; RAX43; RAX43v2.
Low [CVE-2026-11735] stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality
A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality. Affected products named by the advisory: R7000; RAX20; RAX35v2; RAX41; and 4 more. Affected products named by the advisory: RAX41v2; RAX42; RAX42v2; RAX43.
Low [CVE-2026-11734] buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable
A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable. Affected products named by the advisory: MR70; MR90; MS70; MS90; and 4 more. Affected products named by the advisory: RAX41; RAX41v2; RAX42; RAX42v2.
Low [CVE-2026-11733] buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device
A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device. Affected products named by the advisory: RAX41; RAX41v2; RAX42; RAX42v2; and 4 more. Affected products named by the advisory: RAX43; RAX43v2; RAX49S; RAX50.
Low [CVE-2025-12945] Improper input validation in NETGEAR Nighthawk router R7000P
An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability. This issue affects R7000P: through 1.3.3.154.