{"id":"CVE-2026-11739","title":"A command injection vulnerability in certain affected NETGEAR Nighthawk \ndevices allows a network-adjacent attacker with the ability to intercept\n and modify local network traffic (attacker in the middle) to compromise\n the confidentiali…","summary":"A command injection vulnerability in certain affected NETGEAR Nighthawk \ndevices allows a network-adjacent attacker with the ability to intercept\n and modify local network traffic (attacker in the middle) to compromise\n the confidentiali…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-78"],"vendor":"netgear","product":"ms90_firmware","affected":["ms90_firmware < 1.0.2.46","rax20_firmware < 1.0.17.142","rax200_firmware < 1.0.11.148","rax35_firmware < 1.0.17.142","rax35v2_firmware < 1.0.17.142","rax41_firmware < 1.1.6.36","rax41v2_firmware < 1.1.6.36","rax42_firmware < 1.1.6.36","rax42v2_firmware < 1.1.6.36","rax43_firmware < 1.1.6.36","rax43v2_firmware < 1.1.6.36","rax45_firmware < 1.0.17.142","rax49s_firmware < 1.1.6.36","rax50_firmware < 1.1.6.36","rax50v2_firmware < 1.1.6.36","rax54s_firmware < 1.1.6.36","rax54sv2_firmware < 1.1.6.36","rax80_firmware < 1.0.11.148","raxe500_firmware < 1.2.14.110","rs700_firmware < 1.0.9.6","xr1000_firmware < 1.1.0.22","xr1000v2_firmware < 1.1.0.22","mr60_firmware < 1.1.8.142","mr70_firmware < 1.0.4.48","mr90_firmware < 1.0.2.46","ms60_firmware < 1.1.8.142","ms70_firmware < 1.0.4.48"],"patched":["ms90_firmware 1.0.2.46","rax20_firmware 1.0.17.142","rax200_firmware 1.0.11.148","rax35_firmware 1.0.17.142","rax35v2_firmware 1.0.17.142","rax41_firmware 1.1.6.36","rax41v2_firmware 1.1.6.36","rax42_firmware 1.1.6.36","rax42v2_firmware 1.1.6.36","rax43_firmware 1.1.6.36","rax43v2_firmware 1.1.6.36","rax45_firmware 1.0.17.142","rax49s_firmware 1.1.6.36","rax50_firmware 1.1.6.36","rax50v2_firmware 1.1.6.36","rax54s_firmware 1.1.6.36","rax54sv2_firmware 1.1.6.36","rax80_firmware 1.0.11.148","raxe500_firmware 1.2.14.110","rs700_firmware 1.0.9.6","xr1000_firmware 1.1.0.22","xr1000v2_firmware 1.1.0.22","mr60_firmware 1.1.8.142","mr70_firmware 1.0.4.48","mr90_firmware 1.0.2.46","ms60_firmware 1.1.8.142","ms70_firmware 1.0.4.48"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T02:59:22.507","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11739","references":[{"url":"https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/mr60/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/mr70/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/mr90/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/ms60/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/ms70/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/ms90/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax20/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax200/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax35/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax35v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax41v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax42v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax45/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax49s/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax80/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/raxe500/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs700/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd"],"epss":0.01068,"epssPercentile":0.63304,"ingestedAt":"2026-08-29T19:41:14.518Z","slug":"CVE-2026-11739","body":"## Overview\n\nA command injection vulnerability in certain affected NETGEAR Nighthawk \ndevices allows a network-adjacent attacker with the ability to intercept\n and modify local network traffic (attacker in the middle) to compromise\n the confidentiality and integrity of the affected device.\n\n## Affected\n\n- `ms90_firmware < 1.0.2.46`\n- `rax20_firmware < 1.0.17.142`\n- `rax200_firmware < 1.0.11.148`\n- `rax35_firmware < 1.0.17.142`\n- `rax35v2_firmware < 1.0.17.142`\n- `rax41_firmware < 1.1.6.36`\n- `rax41v2_firmware < 1.1.6.36`\n- `rax42_firmware < 1.1.6.36`\n- `rax42v2_firmware < 1.1.6.36`\n- `rax43_firmware < 1.1.6.36`\n- `rax43v2_firmware < 1.1.6.36`\n- `rax45_firmware < 1.0.17.142`\n- `rax49s_firmware < 1.1.6.36`\n- `rax50_firmware < 1.1.6.36`\n- `rax50v2_firmware < 1.1.6.36`\n- `rax54s_firmware < 1.1.6.36`\n- `rax54sv2_firmware < 1.1.6.36`\n- `rax80_firmware < 1.0.11.148`\n- `raxe500_firmware < 1.2.14.110`\n- `rs700_firmware < 1.0.9.6`\n- `xr1000_firmware < 1.1.0.22`\n- `xr1000v2_firmware < 1.1.0.22`\n- `mr60_firmware < 1.1.8.142`\n- `mr70_firmware < 1.0.4.48`\n- `mr90_firmware < 1.0.2.46`\n- `ms60_firmware < 1.1.8.142`\n- `ms70_firmware < 1.0.4.48`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ms90_firmware 1.0.2.46`\n- `rax20_firmware 1.0.17.142`\n- `rax200_firmware 1.0.11.148`\n- `rax35_firmware 1.0.17.142`\n- `rax35v2_firmware 1.0.17.142`\n- `rax41_firmware 1.1.6.36`\n- `rax41v2_firmware 1.1.6.36`\n- `rax42_firmware 1.1.6.36`\n- `rax42v2_firmware 1.1.6.36`\n- `rax43_firmware 1.1.6.36`\n- `rax43v2_firmware 1.1.6.36`\n- `rax45_firmware 1.0.17.142`\n- `rax49s_firmware 1.1.6.36`\n- `rax50_firmware 1.1.6.36`\n- `rax50v2_firmware 1.1.6.36`\n- `rax54s_firmware 1.1.6.36`\n- `rax54sv2_firmware 1.1.6.36`\n- `rax80_firmware 1.0.11.148`\n- `raxe500_firmware 1.2.14.110`\n- `rs700_firmware 1.0.9.6`\n- `xr1000_firmware 1.1.0.22`\n- `xr1000v2_firmware 1.1.0.22`\n- `mr60_firmware 1.1.8.142`\n- `mr70_firmware 1.0.4.48`\n- `mr90_firmware 1.0.2.46`\n- `ms60_firmware 1.1.8.142`\n- `ms70_firmware 1.0.4.48`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":201453,"id":"CVE-2026-11739","ts":1789399463746,"field":"cvss","old":null,"new":"6.4"},{"seq":201452,"id":"CVE-2026-11739","ts":1789399463746,"field":"severity","old":"none","new":"medium"},{"seq":200187,"id":"CVE-2026-11739","ts":1789396927760,"field":"cvss","old":"6.4","new":null},{"seq":200186,"id":"CVE-2026-11739","ts":1789396927760,"field":"severity","old":"medium","new":"none"},{"seq":198108,"id":"CVE-2026-11739","ts":1789387965533,"field":"cvss","old":null,"new":"6.4"},{"seq":198107,"id":"CVE-2026-11739","ts":1789387965533,"field":"severity","old":"none","new":"medium"},{"seq":195904,"id":"CVE-2026-11739","ts":1789383305751,"field":"cvss","old":"6.4","new":null},{"seq":195903,"id":"CVE-2026-11739","ts":1789383305751,"field":"severity","old":"medium","new":"none"},{"seq":194833,"id":"CVE-2026-11739","ts":1789380273069,"field":"cvss","old":null,"new":"6.4"},{"seq":194832,"id":"CVE-2026-11739","ts":1789380273069,"field":"severity","old":"none","new":"medium"},{"seq":193620,"id":"CVE-2026-11739","ts":1789378167796,"field":"cvss","old":"6.4","new":null},{"seq":193619,"id":"CVE-2026-11739","ts":1789378167796,"field":"severity","old":"medium","new":"none"},{"seq":192407,"id":"CVE-2026-11739","ts":1789376191749,"field":"cvss","old":null,"new":"6.4"},{"seq":192406,"id":"CVE-2026-11739","ts":1789376191749,"field":"severity","old":"none","new":"medium"},{"seq":191194,"id":"CVE-2026-11739","ts":1789373039572,"field":"cvss","old":"6.4","new":null},{"seq":191193,"id":"CVE-2026-11739","ts":1789373039572,"field":"severity","old":"medium","new":"none"},{"seq":189979,"id":"CVE-2026-11739","ts":1789369094518,"field":"cvss","old":null,"new":"6.4"},{"seq":189978,"id":"CVE-2026-11739","ts":1789369094518,"field":"severity","old":"none","new":"medium"},{"seq":188766,"id":"CVE-2026-11739","ts":1789367990232,"field":"cvss","old":"6.4","new":null},{"seq":188765,"id":"CVE-2026-11739","ts":1789367990232,"field":"severity","old":"medium","new":"none"},{"seq":187549,"id":"CVE-2026-11739","ts":1789364944465,"field":"cvss","old":null,"new":"6.4"},{"seq":187548,"id":"CVE-2026-11739","ts":1789364944465,"field":"severity","old":"none","new":"medium"},{"seq":186336,"id":"CVE-2026-11739","ts":1789362907411,"field":"cvss","old":"6.4","new":null},{"seq":186335,"id":"CVE-2026-11739","ts":1789362907411,"field":"severity","old":"medium","new":"none"},{"seq":185122,"id":"CVE-2026-11739","ts":1789360930143,"field":"cvss","old":null,"new":"6.4"},{"seq":185121,"id":"CVE-2026-11739","ts":1789360930143,"field":"severity","old":"none","new":"medium"},{"seq":183909,"id":"CVE-2026-11739","ts":1789357851823,"field":"cvss","old":"6.4","new":null},{"seq":183908,"id":"CVE-2026-11739","ts":1789357851823,"field":"severity","old":"medium","new":"none"},{"seq":182161,"id":"CVE-2026-11739","ts":1789354055383,"field":"cvss","old":null,"new":"6.4"},{"seq":182160,"id":"CVE-2026-11739","ts":1789354055383,"field":"severity","old":"none","new":"medium"},{"seq":180954,"id":"CVE-2026-11739","ts":1789352879326,"field":"cvss","old":"6.4","new":null},{"seq":180953,"id":"CVE-2026-11739","ts":1789352879326,"field":"severity","old":"medium","new":"none"},{"seq":179747,"id":"CVE-2026-11739","ts":1789349952302,"field":"cvss","old":null,"new":"6.4"},{"seq":179746,"id":"CVE-2026-11739","ts":1789349952302,"field":"severity","old":"none","new":"medium"},{"seq":178540,"id":"CVE-2026-11739","ts":1789347714442,"field":"cvss","old":"6.4","new":null},{"seq":178539,"id":"CVE-2026-11739","ts":1789347714442,"field":"severity","old":"medium","new":"none"},{"seq":177333,"id":"CVE-2026-11739","ts":1789346136546,"field":"cvss","old":null,"new":"6.4"},{"seq":177332,"id":"CVE-2026-11739","ts":1789346136546,"field":"severity","old":"none","new":"medium"},{"seq":176126,"id":"CVE-2026-11739","ts":1789342649170,"field":"cvss","old":"6.4","new":null},{"seq":176125,"id":"CVE-2026-11739","ts":1789342649170,"field":"severity","old":"medium","new":"none"},{"seq":175912,"id":"CVE-2026-11739","ts":1789342262649,"field":"cvss","old":null,"new":"6.4"},{"seq":175911,"id":"CVE-2026-11739","ts":1789342262649,"field":"severity","old":"none","new":"medium"},{"seq":175450,"id":"CVE-2026-11739","ts":1789338287142,"field":"cvss","old":"6.4","new":null},{"seq":175449,"id":"CVE-2026-11739","ts":1789338287142,"field":"severity","old":"medium","new":"none"},{"seq":174245,"id":"CVE-2026-11739","ts":1789334561958,"field":"cvss","old":null,"new":"6.4"},{"seq":174244,"id":"CVE-2026-11739","ts":1789334561958,"field":"severity","old":"none","new":"medium"},{"seq":173040,"id":"CVE-2026-11739","ts":1789333135989,"field":"cvss","old":"6.4","new":null},{"seq":173039,"id":"CVE-2026-11739","ts":1789333135989,"field":"severity","old":"medium","new":"none"},{"seq":171854,"id":"CVE-2026-11739","ts":1789330838445,"field":"cvss","old":null,"new":"6.4"},{"seq":171853,"id":"CVE-2026-11739","ts":1789330838445,"field":"severity","old":"none","new":"medium"}]}