CVE-2026-0420

MediumCVSS 5.9/10Last modified Jul 23, 2026

Description

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle (MiTM) style attacks impacting the product's confidentiality. This vulnerability affects the listed NETGEAR models.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-325

Affected software

Vendor	Product	Versions
NETGEAR	RAX120v1	< V1.2.9.52
NETGEAR	RAX120v2	< V1.2.9.52
NETGEAR	RAX35	< V1.0.6.106
NETGEAR	RAX38	< V1.0.6.106
NETGEAR	RAX40	< V1.0.6.106

References

https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-AdvisoryVendor Advisory
https://www.netgear.com/support/product/rax120v2/Product
https://www.netgear.com/support/product/rax35/Product
https://www.netgear.com/support/product/rax38/Product
https://www.netgear.com/support/product/rax40/Product

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04216.5A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in CVE-2026-04274.6Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to CVE-2026-04281.8Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS CVE-2026-04328.5Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalati CVE-2026-04356.0Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with a CVE-2026-04366.9Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacke CVE-2026-04385.4A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker cou CVE-2026-04544.6An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmwa CVE-2026-04555.9The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthoriz CVE-2026-04601.0Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, poten CVE-2026-04617.5Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded CVE-2026-04655.6A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potential