InfoSec Signals™
Sign InStart Free
Back to CVE records
Medium 4.9Published Aug 11, 2026

CVE-2026-11739Command injection vulnerability in some NETGEAR Nighthawk devices

Updated under an hour ago ()

Does this affect you?

It affects NETGEAR MR60 and 53 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

CVSS
4.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber
Weakness (CWE)
CWE-78
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
NETGEAR
NVD analysis
Analyzed
Record last updated
Aug 12, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
NETGEAR MR60
netgear:mr60 (from the name)
before V1.1.8.142
CNA record
NETGEAR MR70
netgear:mr70 (from the name)
before V1.0.4.48
CNA record
NETGEAR MR90
netgear:mr90 (from the name)
before V1.0.2.46
CNA record
NETGEAR MS60
netgear:ms60 (from the name)
before V1.1.8.142
CNA record
NETGEAR MS70
netgear:ms70 (from the name)
before V1.0.4.48
CNA record
NETGEAR MS90
netgear:ms90 (from the name)
before V1.0.2.46
CNA record
NETGEAR RAX20
netgear:rax20 (from the name)
before V1.0.17.142
CNA record
NETGEAR RAX200
netgear:rax200 (from the name)
before V1.0.11.148
CNA record
NETGEAR RAX35
netgear:rax35 (from the name)
before V1.0.17.142
CNA record
NETGEAR RAX35v2
netgear:rax35v2 (from the name)
before V1.0.17.142
CNA record
NETGEAR RAX41
netgear:rax41 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX41v2
netgear:rax41v2 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX42
netgear:rax42 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX42v2
netgear:rax42v2 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX43
netgear:rax43 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX43v2
netgear:rax43v2 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX45
netgear:rax45 (from the name)
before V1.0.17.142
CNA record
NETGEAR RAX49S
netgear:rax49s (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX50
netgear:rax50 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX50v2
netgear:rax50v2 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX54S
netgear:rax54s (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX54Sv2
netgear:rax54sv2 (from the name)
before V1.1.6.36
CNA record
NETGEAR RAX80
netgear:rax80 (from the name)
before V1.0.11.148
CNA record
NETGEAR RAXE500
netgear:raxe500 (from the name)
before V1.2.14.110
CNA record
NETGEAR RS700
netgear:rs700 (from the name)
before V1.0.9.6
CNA record
NETGEAR XR1000
netgear:xr1000 (from the name)
before V1.1.0.22
CNA record
NETGEAR XR1000v2
netgear:xr1000v2 (from the name)
before V1.1.0.22
CNA record
netgear ms90_firmware
netgear:ms90_firmware
before 1.0.2.46
NVD
netgear rax20_firmware
netgear:rax20_firmware
before 1.0.17.142
NVD
netgear rax200_firmware
netgear:rax200_firmware
before 1.0.11.148
NVD
netgear rax35_firmware
netgear:rax35_firmware
before 1.0.17.142
NVD
netgear rax35v2_firmware
netgear:rax35v2_firmware
before 1.0.17.142
NVD
netgear rax41_firmware
netgear:rax41_firmware
before 1.1.6.36
NVD
netgear rax41v2_firmware
netgear:rax41v2_firmware
before 1.1.6.36
NVD
netgear rax42_firmware
netgear:rax42_firmware
before 1.1.6.36
NVD
netgear rax42v2_firmware
netgear:rax42v2_firmware
before 1.1.6.36
NVD
netgear rax43_firmware
netgear:rax43_firmware
before 1.1.6.36
NVD
netgear rax43v2_firmware
netgear:rax43v2_firmware
before 1.1.6.36
NVD
netgear rax45_firmware
netgear:rax45_firmware
before 1.0.17.142
NVD
netgear rax49s_firmware
netgear:rax49s_firmware
before 1.1.6.36
NVD
netgear rax50_firmware
netgear:rax50_firmware
before 1.1.6.36
NVD
netgear rax50v2_firmware
netgear:rax50v2_firmware
before 1.1.6.36
NVD
netgear rax54s_firmware
netgear:rax54s_firmware
before 1.1.6.36
NVD
netgear rax54sv2_firmware
netgear:rax54sv2_firmware
before 1.1.6.36
NVD
netgear rax80_firmware
netgear:rax80_firmware
before 1.0.11.148
NVD
netgear raxe500_firmware
netgear:raxe500_firmware
before 1.2.14.110
NVD
netgear rs700_firmware
netgear:rs700_firmware
before 1.0.9.6
NVD
netgear xr1000_firmware
netgear:xr1000_firmware
before 1.1.0.22
NVD
netgear xr1000v2_firmware
netgear:xr1000v2_firmware
before 1.1.0.22
NVD
netgear mr60_firmware
netgear:mr60_firmware
before 1.1.8.142
NVD
netgear mr70_firmware
netgear:mr70_firmware
before 1.0.4.48
NVD
netgear mr90_firmware
netgear:mr90_firmware
before 1.0.2.46
NVD
netgear ms60_firmware
netgear:ms60_firmware
before 1.1.8.142
NVD
netgear ms70_firmware
netgear:ms70_firmware
before 1.0.4.48
NVD

References

  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • product, patch
  • vendor-advisory

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.