CVE-2026-11732Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models
Updated under an hour ago ()
Does this affect you?
It affects NETGEAR CAX30 and 3 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.24%, higher than 14% of scored CVEs.
Do this next
Free account, 1 product
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-20
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.24% (percentile 14)
- Assigned by
- NETGEAR
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 13, 2026
Affected products
NETGEAR CAX30 netgear:cax30 (from the name) | before V2.3.4.12 | CNA record |
NETGEAR RAX30 netgear:rax30 (from the name) | before V1.0.14.108 | CNA record |
NETGEAR RAX5 netgear:rax5 (from the name) | before V1.0.5.34 | CNA record |
NETGEAR RAXE300 netgear:raxe300 (from the name) | before V1.0.10.72 | CNA record |
References
- https://www.netgear.com/support/product/cax30/product, patch
- https://www.netgear.com/support/product/rax5/product, patch
- https://www.netgear.com/support/product/rax30/product, patch
- https://www.netgear.com/support/product/raxe300/product, patch
- https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisoryvendor-advisory, patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.