{"id":"CVE-2026-11730","title":"Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated admi…","summary":"Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated admi…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-335"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T17:17:39.130","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11730","references":[{"url":"https://www.netgear.com/support/product/ex3700","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/ex6120","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd"],"ingestedAt":"2026-10-13T15:33:40.075Z","slug":"CVE-2026-11730","body":"## Overview\n\nInsufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":219830,"id":"CVE-2026-11730","ts":1791913237322,"field":"cvss","old":null,"new":"5.4"},{"seq":219829,"id":"CVE-2026-11730","ts":1791913237322,"field":"severity","old":"none","new":"medium"}]}