Netgear patches medium-severity command execution and session hijack flaws in several routers and extenders; EoS models remain unfixed
Netgear has released firmware fixes for several medium-severity vulnerabilities (CVE-2026-11732, CVE-2026-11731, CVE-2026-11730, CVE-2026-9218) in a small set of Nighthawk, Orbi and range extender models. All require the attacker to already have local network access, and the flaws could allow unauthorized command execution, changes to administrative settings or hijacking of an admin session. The article does not report active exploitation. Several affected devices are end of service (EoS), and for some of them the latest firmware does not fix the flaw, so Netgear advises replacing them.
Entenda a falha
A vulnerabilidade
Netgear fixed four medium-severity flaws in several routers and extenders. CVE-2026-11732 lets an attacker already on the network (for example with Wi-Fi credentials) run unauthorized commands, but only if Block Sites is enabled (CAX30, RAX30, RAX5, RAXE300). CVE-2026-9218 lets an attacker on the LAN who holds the admin username and password run commands (CBR40, R7000, R7000P, RAX40, R7300DST, all EoS). CVE-2026-11731 lets an unauthenticated attacker with local access to the management service view and change device details and admin settings (RAX28, RAX29). CVE-2026-11730 allows hijacking an authenticated admin session on the web portal (EX3700, EX6120). The articles give no firmware version numbers. The latest firmware does not fix the CBR40 or R7300DST.
Como funciona
The articles give only a high-level picture. In all four cases the attacker must first be on the local network, and the flaws are reached through the router's management side: the web management portal, the management service, or a feature such as Block Sites. For CVE-2026-11732 the feature must be enabled, and for CVE-2026-9218 valid admin credentials are needed. The articles do not explain the internal steps at which processing goes wrong.
Por que é vulnerável
The articles do not state the root cause of any of the four flaws. The outcomes they describe are command execution, exposure and modification of admin settings without authentication on the management service, and session hijacking, but they do not say whether the cause is a missing check, unsafe input handling or something else. They also do not explain why the flaws went unnoticed or what the patches change. For EoS models the cause stays unfixed.
Como foi descoberta
According to ZDNET, the flaws are described in a Netgear security advisory, which is how they reached the public along with firmware releases. The articles do not say who found them, when they were reported, or whether they had been seen before. They report no active exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 15:17.
Detalhes técnicos
- CVE-2026-11732: an attacker already on the network (for example, with Wi-Fi credentials) can run unauthorized commands. It is exploitable only when the Block Sites feature is enabled. Affected: CAX30, RAX30, RAX5 (EoS), RAXE300.
- CVE-2026-11731: an unauthenticated attacker with local access to the management service can view and modify device details and administrative settings. Affected: RAX28, RAX29.
- CVE-2026-11730: an attacker with local network access can hijack an authenticated administrator session on the web management portal. Affected: range extenders EX3700 (EoS) and EX6120.
- CVE-2026-9218: an attacker on the local network who holds the administrator username and password can run unauthorized commands. Affected, all EoS: CBR40, R7000, R7000P, RAX40, R7300DST. The article says the latest firmware does not fix the flaw on the CBR40 or the R7300DST.
Remediação
- Update to the latest firmware through the router settings or from the Netgear download pages.
- Replace EoS devices that will not receive fixes, such as the CBR40 and R7300DST, as Netgear advises.
- Disable the Block Sites feature where patching is not possible, since CVE-2026-11732 is exploitable only when it is enabled. This is an inference from the article, not a vendor recommendation.
- Restrict access to the local network and protect Wi-Fi and administrator credentials.
Linha do tempo
-
Netgear patches medium-severity command execution and session hijack flaws in several routers and extenders; EoS models remain unfixed
ler a análise desta fonte ocultar
Netgear has released firmware fixes for several medium-severity vulnerabilities (CVE-2026-11732, CVE-2026-11731, CVE-2026-11730, CVE-2026-9218) in a small set of Nighthawk, Orbi and range extender models. All require the attacker to already have local network access, and the flaws could allow unauthorized command execution, changes to administrative settings or hijacking of an admin session. The article does not report active exploitation. Several affected devices are end of service (EoS), and for some of them the latest firmware does not fix the flaw, so Netgear advises replacing them.
Technical Details
- CVE-2026-11732: an attacker already on the network (for example, with Wi-Fi credentials) can run unauthorized commands. It is exploitable only when the Block Sites feature is enabled. Affected: CAX30, RAX30, RAX5 (EoS), RAXE300.
- CVE-2026-11731: an unauthenticated attacker with local access to the management service can view and modify device details and administrative settings. Affected: RAX28, RAX29.
- CVE-2026-11730: an attacker with local network access can hijack an authenticated administrator session on the web management portal. Affected: range extenders EX3700 (EoS) and EX6120.
- CVE-2026-9218: an attacker on the local network who holds the administrator username and password can run unauthorized commands. Affected, all EoS: CBR40, R7000, R7000P, RAX40, R7300DST. The article says the latest firmware does not fix the flaw on the CBR40 or the R7300DST.
Remediation
- Update to the latest firmware through the router settings or from the Netgear download pages.
- Replace EoS devices that will not receive fixes, such as the CBR40 and R7300DST, as Netgear advises.
- Disable the Block Sites feature where patching is not possible, since CVE-2026-11732 is exploitable only when it is enabled. This is an inference from the article, not a vendor recommendation.
- Restrict access to the local network and protect Wi-Fi and administrator credentials.