If you own a Netgear router, it could be exposed to a security flaw that lets an attacker run unauthorized commands on the device. The good news is that the problem affects only a small number of models and that Netgear has already released fixes for those still supported. The bad news is that some routers have reached end of support and will receive no further updates.
The vulnerabilities, described in four CVEs, differ slightly from model to model. In general, they can be exploited by an attacker who already has access to your home network, usually through Wi-Fi credentials. All four are rated medium severity, but they remain a concrete risk, which is why Netgear has rolled out new firmware for each affected model.
Image: netgear.com — https://www.netgear.com:443/
The first problem: Block Sites
The first flaw, CVE-2026-11732, concerns the Block Sites feature, which blocks access to specific websites by domain name or keywords. The problem appears only if the feature is enabled. The affected models include the CAX30 Nighthawk AX6 cable modem router, the RAX30 Nighthawk AX5, the RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E and the RAX5, which is end of service: for that one Netgear advises upgrading to a newer router.
Access to the management panel
The second vulnerability, CVE-2026-11731, lets an unauthenticated attacker on the local network view and modify some device details and administrative settings. Patches cover the RAX28, RAX29 and RAX30.
Extenders and session hijacking
The third flaw, CVE-2026-11730, affects two range extenders. An attacker already on the local network can hijack an authenticated administrator session on the web management portal. The EX6120 AC1200 receives the fix, while the EX3700 AC750 Essentials Edition is end of service, and Netgear suggests moving to a newer device.
Image: netgear.com — https://www.netgear.com:443/
Routers at end of life
The fourth flaw, CVE-2026-9218, requires the attacker to be on the local network and to know the administrator username and password. With those credentials, they can run unauthorized commands. It affects the CBR40 Orbi AC2200, the R7000 Nighthawk AC1900, the R7000P Nighthawk AC2300 and the RAX40 Nighthawk AX4, all end of service. For the CBR40 the latest firmware does not fix the flaw, so Netgear advises moving to a newer model. The same applies to the R7300DST Nighthawk AC1900 DST, also end of service and without a fix for this vulnerability.
In practice, if you own a router on this list, check the model and install the firmware from the device's settings or from the Netgear website. If your model is end of service, the only safe route is to replace the device.
No comments yet. Be the first!