{"id":"CVE-2026-11735","title":"A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.","summary":"A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-121"],"vendor":"netgear","product":"r7000_firmware","affected":["r7000_firmware","rax20_firmware","rax35v2_firmware < 1.0.16.132","rax41_firmware","rax41v2_firmware < 1.1.4.28","rax42_firmware","rax42v2_firmware < 1.1.4.28","rax43_firmware < 1.0.16.132","rax43v2_firmware < 1.1.4.28","rax45_firmware","rax49s_firmware < 1.1.4.28","rax50_firmware < 1.0.16.132","rax50s_firmware < 1.0.16.132","rax50v2_firmware < 1.1.4.28","rax54sv2_firmware < 1.1.4.28","rax54v2_firmware < 1.1.4.28","raxe450_firmware","raxe500_firmware < 1.2.14.114","xr1000_firmware < 1.1.0.22","xr1000v2_firmware < 1.1.0.22"],"patched":["rax35v2_firmware 1.0.16.132","rax41v2_firmware 1.1.4.28","rax42v2_firmware 1.1.4.28","rax43_firmware 1.0.16.132","rax43v2_firmware 1.1.4.28","rax49s_firmware 1.1.4.28","rax50_firmware 1.0.16.132","rax50s_firmware 1.0.16.132","rax50v2_firmware 1.1.4.28","rax54sv2_firmware 1.1.4.28","rax54v2_firmware 1.1.4.28","raxe500_firmware 1.2.14.114","xr1000_firmware 1.1.0.22","xr1000v2_firmware 1.1.0.22"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T02:58:25.340","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11735","references":[{"url":"https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/r7000/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax20/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax35v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax45/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax49s/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50s/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax54sv2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/raxe450/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/raxe500/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd"],"epss":0.00509,"epssPercentile":0.4243,"ingestedAt":"2026-08-29T19:41:14.348Z","slug":"CVE-2026-11735","body":"## Overview\n\nA stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.\n\n## Affected\n\n- `r7000_firmware`\n- `rax20_firmware`\n- `rax35v2_firmware < 1.0.16.132`\n- `rax41_firmware`\n- `rax41v2_firmware < 1.1.4.28`\n- `rax42_firmware`\n- `rax42v2_firmware < 1.1.4.28`\n- `rax43_firmware < 1.0.16.132`\n- `rax43v2_firmware < 1.1.4.28`\n- `rax45_firmware`\n- `rax49s_firmware < 1.1.4.28`\n- `rax50_firmware < 1.0.16.132`\n- `rax50s_firmware < 1.0.16.132`\n- `rax50v2_firmware < 1.1.4.28`\n- `rax54sv2_firmware < 1.1.4.28`\n- `rax54v2_firmware < 1.1.4.28`\n- `raxe450_firmware`\n- `raxe500_firmware < 1.2.14.114`\n- `xr1000_firmware < 1.1.0.22`\n- `xr1000v2_firmware < 1.1.0.22`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rax35v2_firmware 1.0.16.132`\n- `rax41v2_firmware 1.1.4.28`\n- `rax42v2_firmware 1.1.4.28`\n- `rax43_firmware 1.0.16.132`\n- `rax43v2_firmware 1.1.4.28`\n- `rax49s_firmware 1.1.4.28`\n- `rax50_firmware 1.0.16.132`\n- `rax50s_firmware 1.0.16.132`\n- `rax50v2_firmware 1.1.4.28`\n- `rax54sv2_firmware 1.1.4.28`\n- `rax54v2_firmware 1.1.4.28`\n- `raxe500_firmware 1.2.14.114`\n- `xr1000_firmware 1.1.0.22`\n- `xr1000v2_firmware 1.1.0.22`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201445,"id":"CVE-2026-11735","ts":1789399463180,"field":"cvss","old":null,"new":"4.9"},{"seq":201444,"id":"CVE-2026-11735","ts":1789399463180,"field":"severity","old":"none","new":"medium"},{"seq":200179,"id":"CVE-2026-11735","ts":1789396927731,"field":"cvss","old":"4.9","new":null},{"seq":200178,"id":"CVE-2026-11735","ts":1789396927731,"field":"severity","old":"medium","new":"none"},{"seq":198100,"id":"CVE-2026-11735","ts":1789387964941,"field":"cvss","old":null,"new":"4.9"},{"seq":198099,"id":"CVE-2026-11735","ts":1789387964941,"field":"severity","old":"none","new":"medium"},{"seq":195896,"id":"CVE-2026-11735","ts":1789383305723,"field":"cvss","old":"4.9","new":null},{"seq":195895,"id":"CVE-2026-11735","ts":1789383305723,"field":"severity","old":"medium","new":"none"},{"seq":194825,"id":"CVE-2026-11735","ts":1789380273018,"field":"cvss","old":null,"new":"4.9"},{"seq":194824,"id":"CVE-2026-11735","ts":1789380273018,"field":"severity","old":"none","new":"medium"},{"seq":193612,"id":"CVE-2026-11735","ts":1789378167766,"field":"cvss","old":"4.9","new":null},{"seq":193611,"id":"CVE-2026-11735","ts":1789378167766,"field":"severity","old":"medium","new":"none"},{"seq":192399,"id":"CVE-2026-11735","ts":1789376191695,"field":"cvss","old":null,"new":"4.9"},{"seq":192398,"id":"CVE-2026-11735","ts":1789376191695,"field":"severity","old":"none","new":"medium"},{"seq":191186,"id":"CVE-2026-11735","ts":1789373039545,"field":"cvss","old":"4.9","new":null},{"seq":191185,"id":"CVE-2026-11735","ts":1789373039545,"field":"severity","old":"medium","new":"none"},{"seq":189971,"id":"CVE-2026-11735","ts":1789369094468,"field":"cvss","old":null,"new":"4.9"},{"seq":189970,"id":"CVE-2026-11735","ts":1789369094468,"field":"severity","old":"none","new":"medium"},{"seq":188758,"id":"CVE-2026-11735","ts":1789367990205,"field":"cvss","old":"4.9","new":null},{"seq":188757,"id":"CVE-2026-11735","ts":1789367990205,"field":"severity","old":"medium","new":"none"},{"seq":187541,"id":"CVE-2026-11735","ts":1789364943979,"field":"cvss","old":null,"new":"4.9"},{"seq":187540,"id":"CVE-2026-11735","ts":1789364943979,"field":"severity","old":"none","new":"medium"},{"seq":186328,"id":"CVE-2026-11735","ts":1789362907376,"field":"cvss","old":"4.9","new":null},{"seq":186327,"id":"CVE-2026-11735","ts":1789362907376,"field":"severity","old":"medium","new":"none"},{"seq":185114,"id":"CVE-2026-11735","ts":1789360929683,"field":"cvss","old":null,"new":"4.9"},{"seq":185113,"id":"CVE-2026-11735","ts":1789360929683,"field":"severity","old":"none","new":"medium"},{"seq":183901,"id":"CVE-2026-11735","ts":1789357851795,"field":"cvss","old":"4.9","new":null},{"seq":183900,"id":"CVE-2026-11735","ts":1789357851795,"field":"severity","old":"medium","new":"none"},{"seq":182153,"id":"CVE-2026-11735","ts":1789354055356,"field":"cvss","old":null,"new":"4.9"},{"seq":182152,"id":"CVE-2026-11735","ts":1789354055356,"field":"severity","old":"none","new":"medium"},{"seq":180946,"id":"CVE-2026-11735","ts":1789352879298,"field":"cvss","old":"4.9","new":null},{"seq":180945,"id":"CVE-2026-11735","ts":1789352879298,"field":"severity","old":"medium","new":"none"},{"seq":179739,"id":"CVE-2026-11735","ts":1789349952277,"field":"cvss","old":null,"new":"4.9"},{"seq":179738,"id":"CVE-2026-11735","ts":1789349952277,"field":"severity","old":"none","new":"medium"},{"seq":178532,"id":"CVE-2026-11735","ts":1789347714405,"field":"cvss","old":"4.9","new":null},{"seq":178531,"id":"CVE-2026-11735","ts":1789347714405,"field":"severity","old":"medium","new":"none"},{"seq":177325,"id":"CVE-2026-11735","ts":1789346136103,"field":"cvss","old":null,"new":"4.9"},{"seq":177324,"id":"CVE-2026-11735","ts":1789346136103,"field":"severity","old":"none","new":"medium"},{"seq":176118,"id":"CVE-2026-11735","ts":1789342649140,"field":"cvss","old":"4.9","new":null},{"seq":176117,"id":"CVE-2026-11735","ts":1789342649140,"field":"severity","old":"medium","new":"none"},{"seq":175904,"id":"CVE-2026-11735","ts":1789342262616,"field":"cvss","old":null,"new":"4.9"},{"seq":175903,"id":"CVE-2026-11735","ts":1789342262616,"field":"severity","old":"none","new":"medium"},{"seq":175442,"id":"CVE-2026-11735","ts":1789338287112,"field":"cvss","old":"4.9","new":null},{"seq":175441,"id":"CVE-2026-11735","ts":1789338287112,"field":"severity","old":"medium","new":"none"},{"seq":174237,"id":"CVE-2026-11735","ts":1789334561933,"field":"cvss","old":null,"new":"4.9"},{"seq":174236,"id":"CVE-2026-11735","ts":1789334561933,"field":"severity","old":"none","new":"medium"},{"seq":173032,"id":"CVE-2026-11735","ts":1789333135495,"field":"cvss","old":"4.9","new":null},{"seq":173031,"id":"CVE-2026-11735","ts":1789333135495,"field":"severity","old":"medium","new":"none"},{"seq":171846,"id":"CVE-2026-11735","ts":1789330838419,"field":"cvss","old":null,"new":"4.9"},{"seq":171845,"id":"CVE-2026-11735","ts":1789330838419,"field":"severity","old":"none","new":"medium"}]}