CVE-2026-11730

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-335

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 19, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-117318.8An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to th CVE-2026-117328.8An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a ne CVE-2026-117334.9A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of CVE-2026-117342.7A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become tempo CVE-2026-117354.9A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modi CVE-2026-117364.9A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modific CVE-2026-117374.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local networ CVE-2026-117384.4Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-117396.4A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to inte CVE-2026-11747.5A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component Gr CVE-2026-117423.6The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag CVE-2026-117436.6The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write