---
id: CVE-2026-11730
title: >-
  Insufficient session randomness vulnerability in the listed NETGEAR Extender
  models allows a network-adjacent attacker having network access (such as WiFi
  credentials) to predict valid session identifiers and hijack an authenticated
  admi…
summary: >-
  Insufficient session randomness vulnerability in the listed NETGEAR Extender
  models allows a network-adjacent attacker having network access (such as WiFi
  credentials) to predict valid session identifiers and hijack an authenticated
  admi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-335
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:39.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11730'
references:
  - url: 'https://www.netgear.com/support/product/ex3700'
    label: a2826606-91e7-4eb6-899e-8484bd4575d5
  - url: 'https://www.netgear.com/support/product/ex6120'
    label: a2826606-91e7-4eb6-899e-8484bd4575d5
tags:
  - nvd
ingestedAt: '2026-10-13T15:33:40.075Z'
---

## Overview

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.