CVE-2026-0407

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to bypass the authentication process and access the admin panel.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
NETGEAR	EX5000	< v1.0.1.82
NETGEAR	EX3110	< v1.0.1.82
NETGEAR	EX6110	< v1.0.1.82
NETGEAR	EX2800	< v1.0.1.82

References

https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-AdvisoryVendor Advisory
https://www.netgear.com/support/product/ex2800Product
https://www.netgear.com/support/product/ex3110Patch, Product
https://www.netgear.com/support/product/ex5000Patch, Product
https://www.netgear.com/support/product/ex6110Patch, Product

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04088.0A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and re CVE-2026-04096.4A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet CVE-2026-04104.5Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorized changes to router CVE-2026-04118.0An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to CVE-2026-04124.5Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows adminis CVE-2026-04134.5A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connec CVE-2026-04144.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04154.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04164.5An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local n CVE-2026-04174.5Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network CVE-2026-04184.5Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper wit CVE-2026-04198.0Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to th