CVE-2026-0417

MediumCVSS 4.5/10Last modified Jul 23, 2026

Description

Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network to tamper with the router's integrity.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
NETGEARMR60< V1.1.7.132
NETGEARMR70< V1.0.3.28
NETGEARMR80< V1.1.7.14
NETGEARMS60< V1.1.7.132
NETGEARMS70< V1.0.3.28
NETGEARMS80< V1.1.7.14
NETGEARR6400v2< V1.0.4.128
NETGEARR6700v3< V1.0.4.128
NETGEARR6900P< V1.3.3.152
NETGEARR7000< V1.0.11.216
NETGEARR7000P< V1.3.3.152
NETGEARR7960P< V1.4.4.92
NETGEARR8000P< V1.4.4.92
NETGEARR8500<= 1.0.2.160
NETGEARRAX20< V1.0.18.144
NETGEARRAX35v2< V1.0.16.132
NETGEARRAX40v2< V1.0.12.118
NETGEARRAX41< V1.0.12.118
NETGEARRAX42< V1.0.12.118
NETGEARRAX43< V1.0.12.120
NETGEARRAX45< V1.0.12.118
NETGEARRAX48< V1.0.12.118
NETGEARRAX50< V1.0.12.120
NETGEARRAX50S< V1.0.12.120
NETGEARRAXE450< V1.0.10.86
NETGEARRAXE500< V1.0.10.86
NETGEARXR1000< V1.0.0.68

References

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-04184.5Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper witCVE-2026-04198.0Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to thCVE-2026-04205.9An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attackeCVE-2026-04216.5A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in CVE-2026-04274.6Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to CVE-2026-04281.8Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGSCVE-2026-04328.5Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalatiCVE-2026-04356.0Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with aCVE-2026-04366.9Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attackeCVE-2026-04385.4A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker couCVE-2026-04544.6An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmwaCVE-2026-04555.9The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthoriz
CVE-2026-0417: Medium severity, CVSS 4.5 | Vulnix