{"id":"CVE-2026-11736","title":"A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.","summary":"A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-20","CWE-787"],"vendor":"netgear","product":"rax20_firmware","affected":["rax20_firmware","rax35v2_firmware < 1.0.16.132","rax41_firmware","rax41v2_firmware < 1.1.4.28","rax42_firmware","rax42v2_firmware < 1.1.4.28","rax43_firmware < 1.0.16.132","rax43v2_firmware < 1.1.4.28","rax45_firmware","rax49s_firmware < 1.1.4.28","rax50_firmware < 1.0.16.132","rax50s_firmware","rax50v2_firmware < 1.1.4.28","rax54sv2_firmware < 1.1.4.28","rax54v2_firmware < 1.1.4.28","raxe450_firmware","raxe500_firmware < 1.2.14.114","xr1000_firmware < 1.1.0.22","xr1000v2_firmware < 1.1.0.22"],"patched":["rax35v2_firmware 1.0.16.132","rax41v2_firmware 1.1.4.28","rax42v2_firmware 1.1.4.28","rax43_firmware 1.0.16.132","rax43v2_firmware 1.1.4.28","rax49s_firmware 1.1.4.28","rax50_firmware 1.0.16.132","rax50v2_firmware 1.1.4.28","rax54sv2_firmware 1.1.4.28","rax54v2_firmware 1.1.4.28","raxe500_firmware 1.2.14.114","xr1000_firmware 1.1.0.22","xr1000v2_firmware 1.1.0.22"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T02:58:40.000","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11736","references":[{"url":"https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax20/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax35v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax45/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax49s/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50s/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax54sv2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/raxe450/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/raxe500/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd"],"epss":0.00509,"epssPercentile":0.4243,"ingestedAt":"2026-08-29T19:41:14.392Z","slug":"CVE-2026-11736","body":"## Overview\n\nA stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.\n\n## Affected\n\n- `rax20_firmware`\n- `rax35v2_firmware < 1.0.16.132`\n- `rax41_firmware`\n- `rax41v2_firmware < 1.1.4.28`\n- `rax42_firmware`\n- `rax42v2_firmware < 1.1.4.28`\n- `rax43_firmware < 1.0.16.132`\n- `rax43v2_firmware < 1.1.4.28`\n- `rax45_firmware`\n- `rax49s_firmware < 1.1.4.28`\n- `rax50_firmware < 1.0.16.132`\n- `rax50s_firmware`\n- `rax50v2_firmware < 1.1.4.28`\n- `rax54sv2_firmware < 1.1.4.28`\n- `rax54v2_firmware < 1.1.4.28`\n- `raxe450_firmware`\n- `raxe500_firmware < 1.2.14.114`\n- `xr1000_firmware < 1.1.0.22`\n- `xr1000v2_firmware < 1.1.0.22`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rax35v2_firmware 1.0.16.132`\n- `rax41v2_firmware 1.1.4.28`\n- `rax42v2_firmware 1.1.4.28`\n- `rax43_firmware 1.0.16.132`\n- `rax43v2_firmware 1.1.4.28`\n- `rax49s_firmware 1.1.4.28`\n- `rax50_firmware 1.0.16.132`\n- `rax50v2_firmware 1.1.4.28`\n- `rax54sv2_firmware 1.1.4.28`\n- `rax54v2_firmware 1.1.4.28`\n- `raxe500_firmware 1.2.14.114`\n- `xr1000_firmware 1.1.0.22`\n- `xr1000v2_firmware 1.1.0.22`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201447,"id":"CVE-2026-11736","ts":1789399463322,"field":"cvss","old":null,"new":"4.9"},{"seq":201446,"id":"CVE-2026-11736","ts":1789399463322,"field":"severity","old":"none","new":"medium"},{"seq":200181,"id":"CVE-2026-11736","ts":1789396927738,"field":"cvss","old":"4.9","new":null},{"seq":200180,"id":"CVE-2026-11736","ts":1789396927738,"field":"severity","old":"medium","new":"none"},{"seq":198102,"id":"CVE-2026-11736","ts":1789387965089,"field":"cvss","old":null,"new":"4.9"},{"seq":198101,"id":"CVE-2026-11736","ts":1789387965089,"field":"severity","old":"none","new":"medium"},{"seq":195898,"id":"CVE-2026-11736","ts":1789383305730,"field":"cvss","old":"4.9","new":null},{"seq":195897,"id":"CVE-2026-11736","ts":1789383305730,"field":"severity","old":"medium","new":"none"},{"seq":194827,"id":"CVE-2026-11736","ts":1789380273031,"field":"cvss","old":null,"new":"4.9"},{"seq":194826,"id":"CVE-2026-11736","ts":1789380273031,"field":"severity","old":"none","new":"medium"},{"seq":193614,"id":"CVE-2026-11736","ts":1789378167774,"field":"cvss","old":"4.9","new":null},{"seq":193613,"id":"CVE-2026-11736","ts":1789378167774,"field":"severity","old":"medium","new":"none"},{"seq":192401,"id":"CVE-2026-11736","ts":1789376191709,"field":"cvss","old":null,"new":"4.9"},{"seq":192400,"id":"CVE-2026-11736","ts":1789376191709,"field":"severity","old":"none","new":"medium"},{"seq":191188,"id":"CVE-2026-11736","ts":1789373039552,"field":"cvss","old":"4.9","new":null},{"seq":191187,"id":"CVE-2026-11736","ts":1789373039552,"field":"severity","old":"medium","new":"none"},{"seq":189973,"id":"CVE-2026-11736","ts":1789369094481,"field":"cvss","old":null,"new":"4.9"},{"seq":189972,"id":"CVE-2026-11736","ts":1789369094481,"field":"severity","old":"none","new":"medium"},{"seq":188760,"id":"CVE-2026-11736","ts":1789367990212,"field":"cvss","old":"4.9","new":null},{"seq":188759,"id":"CVE-2026-11736","ts":1789367990212,"field":"severity","old":"medium","new":"none"},{"seq":187543,"id":"CVE-2026-11736","ts":1789364944097,"field":"cvss","old":null,"new":"4.9"},{"seq":187542,"id":"CVE-2026-11736","ts":1789364944097,"field":"severity","old":"none","new":"medium"},{"seq":186330,"id":"CVE-2026-11736","ts":1789362907385,"field":"cvss","old":"4.9","new":null},{"seq":186329,"id":"CVE-2026-11736","ts":1789362907385,"field":"severity","old":"medium","new":"none"},{"seq":185116,"id":"CVE-2026-11736","ts":1789360929801,"field":"cvss","old":null,"new":"4.9"},{"seq":185115,"id":"CVE-2026-11736","ts":1789360929801,"field":"severity","old":"none","new":"medium"},{"seq":183903,"id":"CVE-2026-11736","ts":1789357851802,"field":"cvss","old":"4.9","new":null},{"seq":183902,"id":"CVE-2026-11736","ts":1789357851802,"field":"severity","old":"medium","new":"none"},{"seq":182155,"id":"CVE-2026-11736","ts":1789354055363,"field":"cvss","old":null,"new":"4.9"},{"seq":182154,"id":"CVE-2026-11736","ts":1789354055363,"field":"severity","old":"none","new":"medium"},{"seq":180948,"id":"CVE-2026-11736","ts":1789352879305,"field":"cvss","old":"4.9","new":null},{"seq":180947,"id":"CVE-2026-11736","ts":1789352879305,"field":"severity","old":"medium","new":"none"},{"seq":179741,"id":"CVE-2026-11736","ts":1789349952283,"field":"cvss","old":null,"new":"4.9"},{"seq":179740,"id":"CVE-2026-11736","ts":1789349952283,"field":"severity","old":"none","new":"medium"},{"seq":178534,"id":"CVE-2026-11736","ts":1789347714414,"field":"cvss","old":"4.9","new":null},{"seq":178533,"id":"CVE-2026-11736","ts":1789347714414,"field":"severity","old":"medium","new":"none"},{"seq":177327,"id":"CVE-2026-11736","ts":1789346136216,"field":"cvss","old":null,"new":"4.9"},{"seq":177326,"id":"CVE-2026-11736","ts":1789346136216,"field":"severity","old":"none","new":"medium"},{"seq":176120,"id":"CVE-2026-11736","ts":1789342649148,"field":"cvss","old":"4.9","new":null},{"seq":176119,"id":"CVE-2026-11736","ts":1789342649148,"field":"severity","old":"medium","new":"none"},{"seq":175906,"id":"CVE-2026-11736","ts":1789342262624,"field":"cvss","old":null,"new":"4.9"},{"seq":175905,"id":"CVE-2026-11736","ts":1789342262624,"field":"severity","old":"none","new":"medium"},{"seq":175444,"id":"CVE-2026-11736","ts":1789338287120,"field":"cvss","old":"4.9","new":null},{"seq":175443,"id":"CVE-2026-11736","ts":1789338287120,"field":"severity","old":"medium","new":"none"},{"seq":174239,"id":"CVE-2026-11736","ts":1789334561939,"field":"cvss","old":null,"new":"4.9"},{"seq":174238,"id":"CVE-2026-11736","ts":1789334561939,"field":"severity","old":"none","new":"medium"},{"seq":173034,"id":"CVE-2026-11736","ts":1789333135618,"field":"cvss","old":"4.9","new":null},{"seq":173033,"id":"CVE-2026-11736","ts":1789333135618,"field":"severity","old":"medium","new":"none"},{"seq":171848,"id":"CVE-2026-11736","ts":1789330838426,"field":"cvss","old":null,"new":"4.9"},{"seq":171847,"id":"CVE-2026-11736","ts":1789330838426,"field":"severity","old":"none","new":"medium"}]}