{"id":"CVE-2026-11737","title":"Insufficient input validation vulnerability in the listed \nNETGEAR models allows authenticated administrators connected to the \nlocal network to make unauthorized modification to the device software and \nfunctionality.","summary":"Insufficient input validation vulnerability in the listed \nNETGEAR models allows authenticated administrators connected to the \nlocal network to make unauthorized modification to the device software and \nfunctionality.","severity":"medium","cvss":4.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-20"],"vendor":"netgear","product":"rax20_firmware","affected":["rax20_firmware < 1.0.18.144","rax41_firmware < 1.1.6.36","rax41v2_firmware < 1.1.6.36","rax42_firmware < 1.1.6.36","rax42v2_firmware < 1.1.6.36","rax43_firmware < 1.1.6.36","rax43v2_firmware < 1.1.6.36","rax45_firmware < 1.0.17.142","rax49s_firmware < 1.1.6.36","rax50_firmware < 1.1.6.36","rax50v2_firmware < 1.1.6.36","rax54s_firmware < 1.1.6.36","rax54sv2_firmware < 1.1.6.36"],"patched":["rax20_firmware 1.0.18.144","rax41_firmware 1.1.6.36","rax41v2_firmware 1.1.6.36","rax42_firmware 1.1.6.36","rax42v2_firmware 1.1.6.36","rax43_firmware 1.1.6.36","rax43v2_firmware 1.1.6.36","rax45_firmware 1.0.17.142","rax49s_firmware 1.1.6.36","rax50_firmware 1.1.6.36","rax50v2_firmware 1.1.6.36","rax54s_firmware 1.1.6.36","rax54sv2_firmware 1.1.6.36"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T02:59:15.787","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11737","references":[{"url":"https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax20/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax45/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax49s/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd"],"epss":0.00221,"epssPercentile":0.11243,"ingestedAt":"2026-08-29T19:41:14.437Z","slug":"CVE-2026-11737","body":"## Overview\n\nInsufficient input validation vulnerability in the listed \nNETGEAR models allows authenticated administrators connected to the \nlocal network to make unauthorized modification to the device software and \nfunctionality.\n\n## Affected\n\n- `rax20_firmware < 1.0.18.144`\n- `rax41_firmware < 1.1.6.36`\n- `rax41v2_firmware < 1.1.6.36`\n- `rax42_firmware < 1.1.6.36`\n- `rax42v2_firmware < 1.1.6.36`\n- `rax43_firmware < 1.1.6.36`\n- `rax43v2_firmware < 1.1.6.36`\n- `rax45_firmware < 1.0.17.142`\n- `rax49s_firmware < 1.1.6.36`\n- `rax50_firmware < 1.1.6.36`\n- `rax50v2_firmware < 1.1.6.36`\n- `rax54s_firmware < 1.1.6.36`\n- `rax54sv2_firmware < 1.1.6.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rax20_firmware 1.0.18.144`\n- `rax41_firmware 1.1.6.36`\n- `rax41v2_firmware 1.1.6.36`\n- `rax42_firmware 1.1.6.36`\n- `rax42v2_firmware 1.1.6.36`\n- `rax43_firmware 1.1.6.36`\n- `rax43v2_firmware 1.1.6.36`\n- `rax45_firmware 1.0.17.142`\n- `rax49s_firmware 1.1.6.36`\n- `rax50_firmware 1.1.6.36`\n- `rax50v2_firmware 1.1.6.36`\n- `rax54s_firmware 1.1.6.36`\n- `rax54sv2_firmware 1.1.6.36`","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":24.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201449,"id":"CVE-2026-11737","ts":1789399463463,"field":"cvss","old":null,"new":"4.5"},{"seq":201448,"id":"CVE-2026-11737","ts":1789399463463,"field":"severity","old":"none","new":"medium"},{"seq":200183,"id":"CVE-2026-11737","ts":1789396927746,"field":"cvss","old":"4.5","new":null},{"seq":200182,"id":"CVE-2026-11737","ts":1789396927746,"field":"severity","old":"medium","new":"none"},{"seq":198104,"id":"CVE-2026-11737","ts":1789387965236,"field":"cvss","old":null,"new":"4.5"},{"seq":198103,"id":"CVE-2026-11737","ts":1789387965236,"field":"severity","old":"none","new":"medium"},{"seq":195900,"id":"CVE-2026-11737","ts":1789383305737,"field":"cvss","old":"4.5","new":null},{"seq":195899,"id":"CVE-2026-11737","ts":1789383305737,"field":"severity","old":"medium","new":"none"},{"seq":194829,"id":"CVE-2026-11737","ts":1789380273044,"field":"cvss","old":null,"new":"4.5"},{"seq":194828,"id":"CVE-2026-11737","ts":1789380273044,"field":"severity","old":"none","new":"medium"},{"seq":193616,"id":"CVE-2026-11737","ts":1789378167781,"field":"cvss","old":"4.5","new":null},{"seq":193615,"id":"CVE-2026-11737","ts":1789378167781,"field":"severity","old":"medium","new":"none"},{"seq":192403,"id":"CVE-2026-11737","ts":1789376191722,"field":"cvss","old":null,"new":"4.5"},{"seq":192402,"id":"CVE-2026-11737","ts":1789376191722,"field":"severity","old":"none","new":"medium"},{"seq":191190,"id":"CVE-2026-11737","ts":1789373039558,"field":"cvss","old":"4.5","new":null},{"seq":191189,"id":"CVE-2026-11737","ts":1789373039558,"field":"severity","old":"medium","new":"none"},{"seq":189975,"id":"CVE-2026-11737","ts":1789369094493,"field":"cvss","old":null,"new":"4.5"},{"seq":189974,"id":"CVE-2026-11737","ts":1789369094493,"field":"severity","old":"none","new":"medium"},{"seq":188762,"id":"CVE-2026-11737","ts":1789367990219,"field":"cvss","old":"4.5","new":null},{"seq":188761,"id":"CVE-2026-11737","ts":1789367990219,"field":"severity","old":"medium","new":"none"},{"seq":187545,"id":"CVE-2026-11737","ts":1789364944215,"field":"cvss","old":null,"new":"4.5"},{"seq":187544,"id":"CVE-2026-11737","ts":1789364944215,"field":"severity","old":"none","new":"medium"},{"seq":186332,"id":"CVE-2026-11737","ts":1789362907393,"field":"cvss","old":"4.5","new":null},{"seq":186331,"id":"CVE-2026-11737","ts":1789362907393,"field":"severity","old":"medium","new":"none"},{"seq":185118,"id":"CVE-2026-11737","ts":1789360929915,"field":"cvss","old":null,"new":"4.5"},{"seq":185117,"id":"CVE-2026-11737","ts":1789360929915,"field":"severity","old":"none","new":"medium"},{"seq":183905,"id":"CVE-2026-11737","ts":1789357851809,"field":"cvss","old":"4.5","new":null},{"seq":183904,"id":"CVE-2026-11737","ts":1789357851809,"field":"severity","old":"medium","new":"none"},{"seq":182157,"id":"CVE-2026-11737","ts":1789354055370,"field":"cvss","old":null,"new":"4.5"},{"seq":182156,"id":"CVE-2026-11737","ts":1789354055370,"field":"severity","old":"none","new":"medium"},{"seq":180950,"id":"CVE-2026-11737","ts":1789352879312,"field":"cvss","old":"4.5","new":null},{"seq":180949,"id":"CVE-2026-11737","ts":1789352879312,"field":"severity","old":"medium","new":"none"},{"seq":179743,"id":"CVE-2026-11737","ts":1789349952289,"field":"cvss","old":null,"new":"4.5"},{"seq":179742,"id":"CVE-2026-11737","ts":1789349952289,"field":"severity","old":"none","new":"medium"},{"seq":178536,"id":"CVE-2026-11737","ts":1789347714423,"field":"cvss","old":"4.5","new":null},{"seq":178535,"id":"CVE-2026-11737","ts":1789347714423,"field":"severity","old":"medium","new":"none"},{"seq":177329,"id":"CVE-2026-11737","ts":1789346136327,"field":"cvss","old":null,"new":"4.5"},{"seq":177328,"id":"CVE-2026-11737","ts":1789346136327,"field":"severity","old":"none","new":"medium"},{"seq":176122,"id":"CVE-2026-11737","ts":1789342649155,"field":"cvss","old":"4.5","new":null},{"seq":176121,"id":"CVE-2026-11737","ts":1789342649155,"field":"severity","old":"medium","new":"none"},{"seq":175908,"id":"CVE-2026-11737","ts":1789342262633,"field":"cvss","old":null,"new":"4.5"},{"seq":175907,"id":"CVE-2026-11737","ts":1789342262633,"field":"severity","old":"none","new":"medium"},{"seq":175446,"id":"CVE-2026-11737","ts":1789338287127,"field":"cvss","old":"4.5","new":null},{"seq":175445,"id":"CVE-2026-11737","ts":1789338287127,"field":"severity","old":"medium","new":"none"},{"seq":174241,"id":"CVE-2026-11737","ts":1789334561945,"field":"cvss","old":null,"new":"4.5"},{"seq":174240,"id":"CVE-2026-11737","ts":1789334561945,"field":"severity","old":"none","new":"medium"},{"seq":173036,"id":"CVE-2026-11737","ts":1789333135741,"field":"cvss","old":"4.5","new":null},{"seq":173035,"id":"CVE-2026-11737","ts":1789333135741,"field":"severity","old":"medium","new":"none"},{"seq":171850,"id":"CVE-2026-11737","ts":1789330838432,"field":"cvss","old":null,"new":"4.5"},{"seq":171849,"id":"CVE-2026-11737","ts":1789330838432,"field":"severity","old":"none","new":"medium"}]}