Netgear: Security Vulnerabilities
A path traversal vulnerability in NETGEAR WiFi range extenders allows
an attacker with LAN authentication to access the router's IP and
review the contents of the dynamically generated webproc file, which
records the username and password submitted to the router GUI.
CVSS Score
6.1
EPSS Score
0.003
Published
2026-01-13
An insufficient input validation vulnerability in NETGEAR Orbi routers
allows attackers connected to the router's LAN to execute OS command
injections.
CVSS Score
1.1
EPSS Score
0.003
Published
2026-01-13
An insufficient input validation vulnerability in NETGEAR Orbi devices'
DHCPv6 functionality allows network adjacent attackers authenticated
over WiFi or on LAN to execute OS command injections on the router.
DHCPv6 is not enabled by default.
CVSS Score
4.8
EPSS Score
0.012
Published
2026-01-13
An authentication bypass vulnerability in NETGEAR Orbi devices allows
users connected to the local network to access the router web interface
as an admin.
CVSS Score
6.1
EPSS Score
0.004
Published
2026-01-13
An insufficient input validation vulnerability in the NETGEAR XR1000v2
allows attackers connected to the router's LAN to execute OS command
injections.
CVSS Score
6.1
EPSS Score
0.002
Published
2026-01-13
An insufficient authentication vulnerability in NETGEAR WiFi range
extenders allows a network adjacent attacker with WiFi authentication or
a physical Ethernet port connection to bypass the authentication
process and access the admin panel.
CVSS Score
6.1
EPSS Score
0.003
Published
2026-01-13
Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function.
CVSS Score
6.5
EPSS Score
0.009
Published
2025-12-23
Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function.
CVSS Score
9.8
EPSS Score
0.012
Published
2025-12-23
Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the router.
CVSS Score
5.0
EPSS Score
0.002
Published
2025-12-09
An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionality impacting its integrity. There is no additional impact to confidentiality or availability.
This issue affects R7000P: through 1.3.3.154.
CVSS Score
1.1
EPSS Score
0.011
Published
2025-12-09