CVE-2026-0418

MediumCVSS 4.5/10Last modified Jul 23, 2026

Description

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-15CWE-610

Affected software

VendorProductVersions
NETGEARCBR750< v4.6.14.4
NETGEAREX6120<= 1.0.0.72
NETGEAREX6130<= 1.0.0.54
NETGEARMR60< V1.1.7.128
NETGEARMR70< V1.0.3.28
NETGEARMR80< V1.1.7.6
NETGEARMS60< V1.1.7.128
NETGEARMS70< V1.0.3.28
NETGEARMS80< V1.1.7.6
NETGEARRAX15<= 1.0.18.144
NETGEARRAX20<= 1.0.18.144
NETGEARRAX200<= 1.0.11.148
NETGEARRAX35v2< V1.0.11.112
NETGEARRAX38v2< V1.0.11.112
NETGEARRAX40v2< V1.0.11.112
NETGEARRAX42< V1.0.11.112
NETGEARRAX43< V1.0.11.112
NETGEARRAX45< V1.0.11.112
NETGEARRAX48< V1.0.11.112
NETGEARRAX50< V1.0.11.112
NETGEARRAX50S< V1.0.11.112
NETGEARRAX75<= 1.0.11.148
NETGEARRAX80<= 1.0.11.148
NETGEARRAXE450< V1.0.10.86
NETGEARRAXE500< V1.0.10.86
NETGEARRBR750< V4.6.14.3
NETGEARRBR840< V4.6.14.3
NETGEARRBR850< V4.6.14.3
NETGEARRBRE960< V6.3.7.5
NETGEARRBS750< V4.6.14.3
NETGEARRBS840< V4.6.14.3
NETGEARRBS850< V4.6.14.3
NETGEARRBSE960< V6.3.7.5
NETGEARRS700< V1.0.7.66
NETGEARXR1000< v1.0.0.68

References

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-04198.0Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to thCVE-2026-04205.9An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attackeCVE-2026-04216.5A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in CVE-2026-04274.6Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to CVE-2026-04281.8Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGSCVE-2026-04328.5Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalatiCVE-2026-04356.0Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with aCVE-2026-04366.9Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attackeCVE-2026-04385.4A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker couCVE-2026-04544.6An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmwaCVE-2026-04555.9The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorizCVE-2026-04601.0Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, poten
CVE-2026-0418: Medium severity, CVSS 4.5 | Vulnix