CVE-2026-11730

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-335

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 19, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-117318.8An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to th CVE-2026-117328.8An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a ne CVE-2026-117334.9A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of CVE-2026-117342.7A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become tempo CVE-2026-1173417.7In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is CVE-2026-1173467.5Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit CVE-2026-1173495.3Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.CVE-2026-117354.9A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modi CVE-2026-1173506.5Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.CVE-2026-117364.9A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modific CVE-2026-117374.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local networ CVE-2026-117373Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an o