NETGEAR vulnerabilities
We track 176 vulnerabilities in NETGEAR products across 60+ products. 176 are rated high or critical, and 8 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest NETGEAR vulnerabilities
- 8.8 High severity
RAX30: Missing Authentication for Critical Functionality
A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without
- 8.8 High severity
An insufficient input validation vulnerability in the website blocking feature (Block Sites)…
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized command
- 8.8 High severity
RAX30: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vuln
- 8.1 High severity
A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to…
A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.
- 8.0 High severity
Insufficient authentication and input validation in the listed NETGEAR models allow users…
Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.
- 8.0 High severity
Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit…
Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 ,
- 8.0 High severity
RBE970: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to gain administrator access to the Orbi router. The listed NETGEAR models are affected by this vulnerability. Orbi WiFi Sy
- 7.7 High severity
Rbr20 Firmware: Improper Certificate Validation
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update packages through its auto-update mechanism. An attacker (suitably positioned on the network) could interc
- 7.7 High severity
Rbr20 Firmware: Improper Neutralization of Special Elements used in a Command
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_toke
- 8.0 High severity
EX5000: Improper Authentication
A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically generated webproc file, which records the username and password submitted to the rout
- 8.0 High severity
EX5000: Improper Authentication
An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to bypass the authentication process and access the admin panel.
- 8.0 High severity
An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers…
An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command injections.
- 7.8 High severity
RBE970: Improper Authentication
An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.
- 8.0 High severity
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality…
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.
- 8.0 High severity
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers…
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.
- 7.5 High severity
A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by…
A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands w
- 7.2 High severity
An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service)…
An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router
- 8.8 High severity
Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows…
Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with direct network access to the device to potentially execute code on the device. Please check the firmware version and update to the latest. Fixed in: DGN220
- 7.5 High severity
RAX30: Improper Certificate Validation
Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band WiFi 6E Router) allows attackers with the ability to intercept and tamper traffic destined to the de
- 7.5 High severity
Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows…
Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R6260: through 1.1.0.8
- 7.5 High severity
Rax30 Firmware: Allocation of Resources Without Limits or Throttling
In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited users are connected.
- 9.8 Critical severity
Rax30 Firmware: Unrestricted Upload of File with Dangerous Type
In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and trickin
- 7.5 High severity
R7000 Firmware: Uncontrolled Resource Consumption
In Netgear R7000 V1.3.1.64_10.1.36 and EAX80 V1.0.1.70_1.0.2, the USERLIMIT_GLOBAL option is set to 0 in the bftpd.conf configuration file. This can cause DoS attacks when unlimited users are connected.
- 8.8 High severity
D6400: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, was found in Netgear D6400 1.0.0.114. This affects an unknown part of the file diag.cgi. The manipulation of the argument host_name leads to os command injection. It is possible to initiate the attack remotely
- 8.8 High severity
WNCE3001: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified as critical. This affects the function http_d of the component HTTP POST Request Handler. The manipulation of the argument Host leads to stack-based buffer overflow. It is possible
- 8.8 High severity
EX6150: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.46_1.0.76. This affects the function sub_410090. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed
- 8.8 High severity
EX6100: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Netgear EX6100 1.0.2.28_1.1.138. It has been rated as critical. Affected by this issue is the function sub_415EF8. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been dis
- 8.8 High severity
EX3700: Out-of-bounds Write
A vulnerability was found in Netgear EX3700 up to 1.0.0.88. It has been classified as critical. Affected is the function sub_41619C of the file /mtd. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The explo
- 9.8 Critical severity
WNR614: Improper Authentication
A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible
- 9.8 Critical severity
DGND3700: Improper Authentication
A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This affects an unknown part of the file /BRS_top.html of the component Basic Authentication. The manipulation leads to improper authentication. It is po
- 9.8 Critical severity
Rax50 Firmware: Improper Neutralization of Special Elements used in a Command
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
- 9.8 Critical severity
Rax50 Firmware: Improper Neutralization of Special Elements used in a Command
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
- 9.8 Critical severity
Rax50 Firmware: Improper Neutralization of Special Elements used in a Command
NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
- 9.8 Critical severity
Rax50 Firmware: Improper Neutralization of Special Elements used in a Command
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
- 9.8 Critical severity
Rax50 Firmware: Improper Neutralization of Special Elements used in a Command
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
- 9.8 Critical severity
Rax50 Firmware: Improper Neutralization of Special Elements used in a Command
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
- 9.8 Critical severity
Rax50 Firmware: Improper Neutralization of Special Elements used in a Command
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
- 9.8 Critical severity
EX6200: Buffer Copy without Checking Size of Input
A vulnerability was found in Netgear EX6200 1.0.3.94. It has been declared as critical. This vulnerability affects the function sub_54340. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. The vendor was cont
- 9.8 Critical severity
EX6200: Buffer Copy without Checking Size of Input
A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contac
- 9.8 Critical severity
EX6200: Buffer Copy without Checking Size of Input
A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub_503FC. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was contacted ear