Netgear routers have security flaws

Some Netgear routers are vulnerable to security flaws, according to a report. Netgear has published patches for all supported models, but some routers have reached the end of their support cycle and will no longer receive updates.

Vulnerabilities vary by model

The vulnerabilities vary slightly depending on the different models concerned, as described in Netgear's security advisory. In general, these flaws could be exploited by an attacker who has access to your network, allowing them to execute unauthorized and potentially malicious commands on the router.

Netgear deploys firmware updates

All these flaws are classified as having a medium severity level, but they clearly pose a threat, which has prompted Netgear to deploy a new firmware for each affected model. Users should be able to update their router to the latest firmware version directly from its settings or download each update from Netgear's website.

CVE-2026-11732 affects specific models

CVE-2026-11732 is described as a vulnerability that could allow an attacker who already has access to your network, likely through your Wi-Fi credentials, to execute unauthorized commands on the device. This vulnerability is only exploitable if the "Block Sites" feature is enabled.

Several routers are affected

Affected products include the Modem-router CAX30 Nighthawk AX6 6-Stream WiFi 6, Router RAX30 Nighthawk AX5 5-Stream AX2400 Wi-Fi 6, Router RAX5 4-Stream AX1600 Wi-Fi 6 (end of life), and Router RAXE300 Nighthawk AXE7800 tri-band Wi-Fi 6E. The RAX5 4-Stream AX1600 Wi-Fi 6 router has reached its end of life, meaning no further updates will be available after this one. Netgear advises owners to switch to a more recent router.

CVE-2026-11731 allows unauthorized access

CVE-2026-11731 is a vulnerability that could allow an unauthenticated attacker who has access to your local network and the router's management service to view and modify certain device-related information and administrative settings.

Multiple models are impacted

Affected products include the Router RAX28 Nighthawk AX5 5-Stream AX2200 Wi-Fi 6, Router RAX29 Nighthawk AX2400 Wi-Fi 6, and Router RAX30 Nighthawk AX5 5-Stream AX2400 Wi-Fi 6.

CVE-2026-11730 affects repeaters

CVE-2026-11730 affects two Netgear repeaters, allowing an attacker who already has access to the local network to hijack an authenticated administrator session on the device's web management portal.

End-of-life repeaters are vulnerable

Affected products include the Wi-Fi Repeater EX3700 AC750 Essentials Edition (end of support) and the Dual-band Wi-Fi Repeater EX6120 AC1200. The Wi-Fi Repeater EX3700 AC750 Essentials Edition has reached its end of life, meaning it is time to switch to a newer device.

CVE-2026-9218 allows command execution

CVE-2026-9218 is a vulnerability that allows an attacker connected to the router's local network and possessing the administrator username and password to execute unauthorized commands on the device.

Multiple devices are affected

Affected products include the Tri-band Wi-Fi Cable Modem Router CBR40 Orbi AC2200 (end of support), Gigabit Dual-band Smart Wi-Fi Router R7000 Nighthawk AC1900 (end of life), Gigabit Dual-band Smart Wi-Fi Router Nighthawk AC2300 R7000P (EoS), Wi-Fi Nighthawk AX4 4-Stream RAX40 (EoS), and Router and Adapter R7300DST Nighthawk AC1900 DST (end of service). The latest firmware will not fix the current security flaw for the Tri-band Wi-Fi Cable Modem Router CBR40 Orbi AC2200, and owners should switch to a newer device to ensure their security.

Other affected devices are outdated

The other Netgear routers affected by these security vulnerabilities are also at the end of their life, and the latest firmware versions will not fix their security flaws. Netgear advises owners to switch to a newer and more secure device.