CVE-2026-9214 | | | 2026-08-11 | Insufficient input validation vulnerability in the NETGEAR R7000 models
allows authenticated administrators connected to the local network to
make unauthoriz… |
CVE-2026-11814 | | | 2026-08-11 | A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffi… |
CVE-2026-11739 | | | 2026-08-11 | A command injection vulnerability in certain affected NETGEAR Nighthawk
devices allows a network-adjacent attacker with the ability to intercept
and modify l… |
CVE-2026-11738 | | | 2026-08-11 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-11737 | | | 2026-08-11 | Insufficient input validation vulnerability in the listed
NETGEAR models allows authenticated administrators connected to the
local network to make unauthori… |
CVE-2026-11736 | | | 2026-08-11 | A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router sof… |
CVE-2026-11735 | | | 2026-08-11 | A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the rou… |
CVE-2026-11734 | | | 2026-08-11 | A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable. |
CVE-2026-11733 | | | 2026-08-11 | A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device. |
CVE-2026-62659 | | | 2026-07-14 | A
security flaw was discovered in the NETGEAR WAX333 Access Point that could
allow someone already logged in and connected to the local network to make
unautho… |
CVE-2026-62658 | | | 2026-07-14 | A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers
that could allow someone already logged in to the device to run unauthorized com… |
CVE-2026-62657 | | | 2026-07-14 | A security flaw in the router's certificate validation process was
discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow… |
CVE-2026-62656 | | | 2026-07-14 | A
security flaw was found in certain NETGEAR RAX models that could allow
a logged-in user to send specially crafted requests to the router and run
unauthorized… |
CVE-2026-62655 | | | 2026-07-14 | A
security flaw was found in certain NETGEAR Orbi models that
could allow an unauthorized user to cause the device to stop responding or
restart unexpectedly… |
CVE-2026-15757 | | | 2026-07-14 | A security flaw was discovered in the NETGEAR DGND3700v1 that could
allow someone on the same local WiFi network to send unauthorized commands to
the device.
… |
CVE-2026-9213 | High | 8.1 | 2026-06-09 | A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Intern… |
CVE-2026-9212 | High | 8.0 | 2026-06-09 | Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the prod… |
CVE-2026-9211 | High | 8.8 | 2026-06-09 | An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation. |
CVE-2026-9210 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-3088 | Medium | 6.5 | 2026-06-09 | Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests. |
CVE-2026-0420 | Medium | 5.9 | 2026-06-09 | An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attack… |
CVE-2026-0419 | High | 8.0 | 2026-06-09 | Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networ… |
CVE-2026-0418 | Medium | 4.5 | 2026-06-09 | Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network
to tamper with the system. |
CVE-2026-0417 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR devices allows
authenticated administrators connected to the local network to tamper with
the… |
CVE-2026-0416 | Medium | 4.5 | 2026-06-09 | An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local network access to su… |
CVE-2026-0415 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-0414 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-0413 | Medium | 4.5 | 2026-06-09 | A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connected to the local ne… |
CVE-2026-0412 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows administrators connected t… |
CVE-2026-0411 | High | 8.0 | 2026-06-09 | An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to gain administrator… |
CVE-2026-0410 | Medium | 4.5 | 2026-06-09 | Authenticated administrators connected to the local network can gain
elevated access to the router and make unauthorized changes to router
software and funct… |
CVE-2026-0409 | Medium | 6.4 | 2026-06-09 | A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet to run commands on… |
CVE-2026-24714 | High | 7.5 | 2026-01-30 | Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box. |
CVE-2022-40620 | High | 7.7 | 2026-01-28 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update pack… |
CVE-2022-40619 | High | 7.7 | 2026-01-28 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This… |
CVE-2026-0408 | High | 8.0 | 2026-01-13 | A path traversal vulnerability in NETGEAR WiFi range extenders allows
an attacker with LAN authentication to access the router's IP and
review the contents o… |
CVE-2026-0407 | High | 8.0 | 2026-01-13 | An insufficient authentication vulnerability in NETGEAR WiFi range
extenders allows a network adjacent attacker with WiFi authentication or
a physical Ethern… |
CVE-2026-0406 | High | 8.0 | 2026-01-13 | An insufficient input validation vulnerability in the NETGEAR XR1000v2
allows attackers connected to the router's LAN to execute OS command
injections. |
CVE-2026-0405 | High | 7.8 | 2026-01-13 | An authentication bypass vulnerability in NETGEAR Orbi devices allows
users connected to the local network to access the router web interface
as an admin. |
CVE-2026-0404 | High | 8.0 | 2026-01-13 | An insufficient input validation vulnerability in NETGEAR Orbi devices'
DHCPv6 functionality allows network adjacent attackers authenticated
over WiFi or on… |
CVE-2026-0403 | High | 8.0 | 2026-01-13 | An insufficient input validation vulnerability in NETGEAR Orbi routers
allows attackers connected to the router's LAN to execute OS command
injections. |
CVE-2025-50526 | Critical | 9.8 | 2025-12-23 | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function. |
CVE-2025-45493 | Medium | 6.5 | 2025-12-23 | Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function. |
CVE-2025-12946 | High | 7.5 | 2025-12-09 | A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN si… |
CVE-2025-12945 | High | 7.2 | 2025-12-09 | A vulnerability in NETGEAR Nighthawk R7000P routers lets an authenticated admin execute OS command injections due to improper input validation.
This issue… |
CVE-2025-12941 | Medium | 5.7 | 2025-12-09 | Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the… |
CVE-2025-12944 | High | 8.8 | 2025-11-11 | Improper input validation
in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with
direct network access to the device to potentially exe… |
CVE-2025-12943 | High | 7.5 | 2025-11-11 | Improper certificate
validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream
AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band… |
CVE-2025-12942 | High | 7.5 | 2025-11-11 | Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attac… |
CVE-2025-12940 | Medium | 5.5 | 2025-11-11 | Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610
and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Man… |
CVE-2013-10063 | | | 2025-08-01 | A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can… |
CVE-2013-10061 | High | 7.2 | 2025-08-01 | An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the… |
CVE-2013-10060 | High | 7.2 | 2025-08-01 | An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe… |
CVE-2025-44652 | High | 7.5 | 2025-07-21 | In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited… |
CVE-2025-44658 | Critical | 9.8 | 2025-07-21 | In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An att… |
CVE-2025-44650 | High | 7.5 | 2025-07-21 | In Netgear R7000 V1.3.1.64_10.1.36 and EAX80 V1.0.1.70_1.0.2, the USERLIMIT_GLOBAL option is set to 0 in the bftpd.conf configuration file. This can cause DoS… |
CVE-2025-52082 | Medium | 6.5 | 2025-07-15 | In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs whe… |
CVE-2025-52081 | Medium | 6.5 | 2025-07-15 | In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerabil… |
CVE-2025-52080 | Medium | 6.5 | 2025-07-15 | In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerabil… |
CVE-2025-7407 | Medium | 6.3 | 2025-07-10 | A vulnerability, which was classified as critical, was found in Netgear D6400 1.0.0.114. This affects an unknown part of the file diag.cgi. The manipulation of… |
CVE-2025-6565 | High | 8.8 | 2025-06-24 | A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified as critical. This affects the function http_d of the component HTTP POST Request… |
CVE-2025-6511 | High | 8.8 | 2025-06-23 | A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.46_1.0.76. This affects the function sub_410090. The manipulation leads to stack-… |
CVE-2025-6510 | High | 8.8 | 2025-06-23 | A vulnerability was found in Netgear EX6100 1.0.2.28_1.1.138. It has been rated as critical. Affected by this issue is the function sub_415EF8. The manipulatio… |
CVE-2025-5934 | High | 8.8 | 2025-06-10 | A vulnerability was found in Netgear EX3700 up to 1.0.0.88. It has been classified as critical. Affected is the function sub_41619C of the file /mtd. The manip… |
CVE-2025-5495 | High | 7.3 | 2025-06-03 | A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. Th… |
CVE-2025-4980 | Medium | 5.3 | 2025-05-20 | A vulnerability has been found in Netgear DGND3700 1.1.00.15_1.00.15NA and classified as problematic. This vulnerability affects unknown code of the file /curr… |
CVE-2025-4978 | Critical | 9.8 | 2025-05-20 | A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This affects an unknown part of the file /BRS_top.ht… |
CVE-2025-4977 | Medium | 5.3 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Netgear DGND3700 1.1.00.15_1.00.15NA. Affected by this issue is some unknown functional… |
CVE-2025-45492 | Critical | 9.8 | 2025-05-06 | Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function. |
CVE-2024-57235 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57234 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps functi… |
CVE-2024-57233 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57232 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode f… |
CVE-2024-57231 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fu… |
CVE-2024-57230 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fu… |
CVE-2024-57229 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2025-4150 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94. It has been declared as critical. This vulnerability affects the function sub_54340. The manipulation of… |
CVE-2025-4149 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument… |
CVE-2025-4148 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub_503FC. The manipulation of the argu… |
CVE-2025-4147 | High | 8.8 | 2025-05-01 | A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this vulnerability is the function sub_47F7C. The manipulatio… |
CVE-2025-4146 | High | 8.8 | 2025-05-01 | A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. Affected is the function sub_41940. The manipulation of the argument h… |
CVE-2025-4145 | High | 8.8 | 2025-05-01 | A vulnerability, which was classified as critical, has been found in Netgear EX6200 1.0.3.94. This issue affects the function sub_3D0BC. The manipulation of th… |
CVE-2025-4142 | High | 8.8 | 2025-04-30 | A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. This vulnerability affects the function sub_3C8EC. The manipulation of th… |
CVE-2025-4141 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. This affects the function sub_3C03C. The manipulation of the argument… |
CVE-2025-4140 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, has been found in Netgear EX6120 1.0.3.94. Affected by this issue is the function sub_30394. The manipulatio… |
CVE-2025-4139 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical was found in Netgear EX6120 1.0.0.68. Affected by this vulnerability is the function fwAcosCgiInbound. The manipulation… |
CVE-2025-4135 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulatio… |
CVE-2025-4122 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of… |
CVE-2025-4121 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The ma… |
CVE-2025-4120 | High | 8.8 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manipulation of the argu… |
CVE-2025-4117 | Medium | 5.5 | 2025-04-30 | A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub_41A914. The manipulation of the argu… |
CVE-2025-4116 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, has been found in Netgear JWNR2000v2 1.0.0.11. Affected by this issue is the function get_cur_lang_ver. The… |
CVE-2025-4115 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical was found in Netgear JWNR2000v2 1.0.0.11. Affected by this vulnerability is the function default_version_is_new. The man… |
CVE-2025-4114 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The manipulation of the arg… |
CVE-2025-29044 | Critical | 9.8 | 2025-04-17 | Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key value |
CVE-2024-54809 | Critical | 9.8 | 2025-03-31 | Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header p… |
CVE-2024-54808 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained… |
CVE-2024-54807 | Critical | 9.8 | 2025-03-31 | In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient pa… |
CVE-2024-54806 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web int… |
CVE-2024-54805 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |