{"id":"CVE-2026-11738","title":"Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.","summary":"Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-20"],"vendor":"netgear","product":"be9300_firmware","affected":["be9300_firmware < 1.0.1.84","mr60_firmware < 1.1.8.142","ms60_firmware < 1.1.8.142","r6700ax_firmware < 1.0.18.164","rax10_firmware < 1.0.5.50","rax120_firmware < 1.2.10.56","rax120v2_firmware < 1.2.10.56","rax20_firmware < 1.0.17.142","rax28_firmware < 1.0.14.108","rax29_firmware < 1.0.14.108","rax30_firmware < 1.0.14.108","rax36s_firmware < 1.0.5.50","rax43_firmware < 1.0.17.142","rax45_firmware < 1.0.17.142","rax50_firmware < 1.0.17.142","rax70_firmware < 1.0.19.172","rbr760_firmware < 6.3.8.11","rbs760_firmware < 6.3.8.11","rs100_firmware < 1.0.1.80","rs200_firmware < 1.0.1.90","rs280_firmware < 1.0.1.90","rs300_firmware < 1.0.1.90","rs500_firmware < 1.0.1.90","rs600_firmware < 1.0.1.90","rs70_firmware < 1.0.1.80","rs90_firmware < 1.0.1.80"],"patched":["be9300_firmware 1.0.1.84","mr60_firmware 1.1.8.142","ms60_firmware 1.1.8.142","r6700ax_firmware 1.0.18.164","rax10_firmware 1.0.5.50","rax120_firmware 1.2.10.56","rax120v2_firmware 1.2.10.56","rax20_firmware 1.0.17.142","rax28_firmware 1.0.14.108","rax29_firmware 1.0.14.108","rax30_firmware 1.0.14.108","rax36s_firmware 1.0.5.50","rax43_firmware 1.0.17.142","rax45_firmware 1.0.17.142","rax50_firmware 1.0.17.142","rax70_firmware 1.0.19.172","rbr760_firmware 6.3.8.11","rbs760_firmware 6.3.8.11","rs100_firmware 1.0.1.80","rs200_firmware 1.0.1.90","rs280_firmware 1.0.1.90","rs300_firmware 1.0.1.90","rs500_firmware 1.0.1.90","rs600_firmware 1.0.1.90","rs70_firmware 1.0.1.80","rs90_firmware 1.0.1.80"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T02:59:45.560","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11738","references":[{"url":"https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/r7000/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/raxe500/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs700/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd"],"epss":0.00269,"epssPercentile":0.16959,"ingestedAt":"2026-08-29T19:41:14.478Z","slug":"CVE-2026-11738","body":"## Overview\n\nInsufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.\n\n## Affected\n\n- `be9300_firmware < 1.0.1.84`\n- `mr60_firmware < 1.1.8.142`\n- `ms60_firmware < 1.1.8.142`\n- `r6700ax_firmware < 1.0.18.164`\n- `rax10_firmware < 1.0.5.50`\n- `rax120_firmware < 1.2.10.56`\n- `rax120v2_firmware < 1.2.10.56`\n- `rax20_firmware < 1.0.17.142`\n- `rax28_firmware < 1.0.14.108`\n- `rax29_firmware < 1.0.14.108`\n- `rax30_firmware < 1.0.14.108`\n- `rax36s_firmware < 1.0.5.50`\n- `rax43_firmware < 1.0.17.142`\n- `rax45_firmware < 1.0.17.142`\n- `rax50_firmware < 1.0.17.142`\n- `rax70_firmware < 1.0.19.172`\n- `rbr760_firmware < 6.3.8.11`\n- `rbs760_firmware < 6.3.8.11`\n- `rs100_firmware < 1.0.1.80`\n- `rs200_firmware < 1.0.1.90`\n- `rs280_firmware < 1.0.1.90`\n- `rs300_firmware < 1.0.1.90`\n- `rs500_firmware < 1.0.1.90`\n- `rs600_firmware < 1.0.1.90`\n- `rs70_firmware < 1.0.1.80`\n- `rs90_firmware < 1.0.1.80`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `be9300_firmware 1.0.1.84`\n- `mr60_firmware 1.1.8.142`\n- `ms60_firmware 1.1.8.142`\n- `r6700ax_firmware 1.0.18.164`\n- `rax10_firmware 1.0.5.50`\n- `rax120_firmware 1.2.10.56`\n- `rax120v2_firmware 1.2.10.56`\n- `rax20_firmware 1.0.17.142`\n- `rax28_firmware 1.0.14.108`\n- `rax29_firmware 1.0.14.108`\n- `rax30_firmware 1.0.14.108`\n- `rax36s_firmware 1.0.5.50`\n- `rax43_firmware 1.0.17.142`\n- `rax45_firmware 1.0.17.142`\n- `rax50_firmware 1.0.17.142`\n- `rax70_firmware 1.0.19.172`\n- `rbr760_firmware 6.3.8.11`\n- `rbs760_firmware 6.3.8.11`\n- `rs100_firmware 1.0.1.80`\n- `rs200_firmware 1.0.1.90`\n- `rs280_firmware 1.0.1.90`\n- `rs300_firmware 1.0.1.90`\n- `rs500_firmware 1.0.1.90`\n- `rs600_firmware 1.0.1.90`\n- `rs70_firmware 1.0.1.80`\n- `rs90_firmware 1.0.1.80`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201451,"id":"CVE-2026-11738","ts":1789399463604,"field":"cvss","old":null,"new":"4.4"},{"seq":201450,"id":"CVE-2026-11738","ts":1789399463604,"field":"severity","old":"none","new":"medium"},{"seq":200185,"id":"CVE-2026-11738","ts":1789396927753,"field":"cvss","old":"4.4","new":null},{"seq":200184,"id":"CVE-2026-11738","ts":1789396927753,"field":"severity","old":"medium","new":"none"},{"seq":198106,"id":"CVE-2026-11738","ts":1789387965383,"field":"cvss","old":null,"new":"4.4"},{"seq":198105,"id":"CVE-2026-11738","ts":1789387965383,"field":"severity","old":"none","new":"medium"},{"seq":195902,"id":"CVE-2026-11738","ts":1789383305744,"field":"cvss","old":"4.4","new":null},{"seq":195901,"id":"CVE-2026-11738","ts":1789383305744,"field":"severity","old":"medium","new":"none"},{"seq":194831,"id":"CVE-2026-11738","ts":1789380273056,"field":"cvss","old":null,"new":"4.4"},{"seq":194830,"id":"CVE-2026-11738","ts":1789380273056,"field":"severity","old":"none","new":"medium"},{"seq":193618,"id":"CVE-2026-11738","ts":1789378167789,"field":"cvss","old":"4.4","new":null},{"seq":193617,"id":"CVE-2026-11738","ts":1789378167789,"field":"severity","old":"medium","new":"none"},{"seq":192405,"id":"CVE-2026-11738","ts":1789376191736,"field":"cvss","old":null,"new":"4.4"},{"seq":192404,"id":"CVE-2026-11738","ts":1789376191736,"field":"severity","old":"none","new":"medium"},{"seq":191192,"id":"CVE-2026-11738","ts":1789373039565,"field":"cvss","old":"4.4","new":null},{"seq":191191,"id":"CVE-2026-11738","ts":1789373039565,"field":"severity","old":"medium","new":"none"},{"seq":189977,"id":"CVE-2026-11738","ts":1789369094505,"field":"cvss","old":null,"new":"4.4"},{"seq":189976,"id":"CVE-2026-11738","ts":1789369094505,"field":"severity","old":"none","new":"medium"},{"seq":188764,"id":"CVE-2026-11738","ts":1789367990225,"field":"cvss","old":"4.4","new":null},{"seq":188763,"id":"CVE-2026-11738","ts":1789367990225,"field":"severity","old":"medium","new":"none"},{"seq":187547,"id":"CVE-2026-11738","ts":1789364944339,"field":"cvss","old":null,"new":"4.4"},{"seq":187546,"id":"CVE-2026-11738","ts":1789364944339,"field":"severity","old":"none","new":"medium"},{"seq":186334,"id":"CVE-2026-11738","ts":1789362907402,"field":"cvss","old":"4.4","new":null},{"seq":186333,"id":"CVE-2026-11738","ts":1789362907402,"field":"severity","old":"medium","new":"none"},{"seq":185120,"id":"CVE-2026-11738","ts":1789360930029,"field":"cvss","old":null,"new":"4.4"},{"seq":185119,"id":"CVE-2026-11738","ts":1789360930029,"field":"severity","old":"none","new":"medium"},{"seq":183907,"id":"CVE-2026-11738","ts":1789357851816,"field":"cvss","old":"4.4","new":null},{"seq":183906,"id":"CVE-2026-11738","ts":1789357851816,"field":"severity","old":"medium","new":"none"},{"seq":182159,"id":"CVE-2026-11738","ts":1789354055376,"field":"cvss","old":null,"new":"4.4"},{"seq":182158,"id":"CVE-2026-11738","ts":1789354055376,"field":"severity","old":"none","new":"medium"},{"seq":180952,"id":"CVE-2026-11738","ts":1789352879319,"field":"cvss","old":"4.4","new":null},{"seq":180951,"id":"CVE-2026-11738","ts":1789352879319,"field":"severity","old":"medium","new":"none"},{"seq":179745,"id":"CVE-2026-11738","ts":1789349952295,"field":"cvss","old":null,"new":"4.4"},{"seq":179744,"id":"CVE-2026-11738","ts":1789349952295,"field":"severity","old":"none","new":"medium"},{"seq":178538,"id":"CVE-2026-11738","ts":1789347714432,"field":"cvss","old":"4.4","new":null},{"seq":178537,"id":"CVE-2026-11738","ts":1789347714432,"field":"severity","old":"medium","new":"none"},{"seq":177331,"id":"CVE-2026-11738","ts":1789346136436,"field":"cvss","old":null,"new":"4.4"},{"seq":177330,"id":"CVE-2026-11738","ts":1789346136436,"field":"severity","old":"none","new":"medium"},{"seq":176124,"id":"CVE-2026-11738","ts":1789342649163,"field":"cvss","old":"4.4","new":null},{"seq":176123,"id":"CVE-2026-11738","ts":1789342649163,"field":"severity","old":"medium","new":"none"},{"seq":175910,"id":"CVE-2026-11738","ts":1789342262641,"field":"cvss","old":null,"new":"4.4"},{"seq":175909,"id":"CVE-2026-11738","ts":1789342262641,"field":"severity","old":"none","new":"medium"},{"seq":175448,"id":"CVE-2026-11738","ts":1789338287134,"field":"cvss","old":"4.4","new":null},{"seq":175447,"id":"CVE-2026-11738","ts":1789338287134,"field":"severity","old":"medium","new":"none"},{"seq":174243,"id":"CVE-2026-11738","ts":1789334561952,"field":"cvss","old":null,"new":"4.4"},{"seq":174242,"id":"CVE-2026-11738","ts":1789334561952,"field":"severity","old":"none","new":"medium"},{"seq":173038,"id":"CVE-2026-11738","ts":1789333135864,"field":"cvss","old":"4.4","new":null},{"seq":173037,"id":"CVE-2026-11738","ts":1789333135864,"field":"severity","old":"medium","new":"none"},{"seq":171852,"id":"CVE-2026-11738","ts":1789330838438,"field":"cvss","old":null,"new":"4.4"},{"seq":171851,"id":"CVE-2026-11738","ts":1789330838438,"field":"severity","old":"none","new":"medium"}]}