CVE-2026-11739

MediumCVSS 6.4/10Last modified Oct 23, 2026

Description

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
NETGEARMR60< V1.1.8.142
NETGEARMR70< V1.0.4.48
NETGEARMR90< V1.0.2.46
NETGEARMS60< V1.1.8.142
NETGEARMS70< V1.0.4.48
NETGEARMS90< V1.0.2.46
NETGEARRAX20< V1.0.17.142
NETGEARRAX200< V1.0.11.148
NETGEARRAX35< V1.0.17.142
NETGEARRAX35v2< V1.0.17.142
NETGEARRAX41< V1.1.6.36
NETGEARRAX41v2< V1.1.6.36
NETGEARRAX42< V1.1.6.36
NETGEARRAX42v2< V1.1.6.36
NETGEARRAX43< V1.1.6.36
NETGEARRAX43v2< V1.1.6.36
NETGEARRAX45< V1.0.17.142
NETGEARRAX49S< V1.1.6.36
NETGEARRAX50< V1.1.6.36
NETGEARRAX50v2< V1.1.6.36
NETGEARRAX54S< V1.1.6.36
NETGEARRAX54Sv2< V1.1.6.36
NETGEARRAX80< V1.0.11.148
NETGEARRAXE500< V1.2.14.110
NETGEARRS700< V1.0.9.6
NETGEARXR1000< V1.1.0.22
NETGEARXR1000v2< V1.1.0.22

References

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-11747.5A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component GrCVE-2026-117423.6The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag CVE-2026-117436.6The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and writeCVE-2026-117443.8An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly saniCVE-2026-117458.8A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verCVE-2026-117469.4A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting reCVE-2026-1174668.6In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.CVE-2026-1174686.5Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An autCVE-2026-1174695.4Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operationsCVE-2026-117476.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected CVE-2026-1174706.5Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticatCVE-2026-1174715.4Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to t
CVE-2026-11739: Medium severity, CVSS 6.4 | Vulnix