CVE-2026-0408

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically generated webproc file, which records the username and password submitted to the router GUI.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04096.4A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet CVE-2026-04104.5Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorized changes to router CVE-2026-04118.0An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to CVE-2026-04124.5Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows adminis CVE-2026-04134.5A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connec CVE-2026-04144.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04154.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04164.5An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local n CVE-2026-04174.5Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network CVE-2026-04184.5Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper wit CVE-2026-04198.0Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to th CVE-2026-04205.9An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacke