NETGEAR vulnerabilities
We track 176 vulnerabilities in NETGEAR products across 60+ products. 176 are rated high or critical, and 8 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest NETGEAR vulnerabilities
- 9.8 Critical severity
NETGEAR ProSAFE Network Management System: Missing Authentication for Critical Functionality
NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.
- 9.8 Critical severity
r6400v2: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to httpd.
- 8.8 High severity
jwnr2000v2: Buffer Copy without Checking Size of Input
Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the check_auth function.
- 8.8 High severity
dc112a: Buffer Copy without Checking Size of Input
Netgear DC112A 1.0.0.64, EX6200 1.0.3.94 and R6300v2 1.0.4.8 were discovered to contain a buffer overflow via the http_passwd parameter in password.cgi.
- 8.8 High severity
jwnr2000v2: Buffer Copy without Checking Size of Input
Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the update_auth function.
- 8.8 High severity
wg302v2: Improper Neutralization of Special Elements used in a Command
Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmwareRestore and firmwareServerip parameters.
- 8.8 High severity
D6220 Firmware: Improper Neutralization of Special Elements used in a Command
Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2.26 are vulnerable to Command Injection. If an attacker gains web management privileges, they can inj
- 9.8 Critical severity
R6250 Firmware: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.
- 9.8 Critical severity
R6900 Firmware: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute arbitrary code and cause a denial ofservice via the getInputData parameter of the fwSchedule.cgi page.
- 8.0 High severity
R6700v3: Improper Neutralization of Special Elements used in an OS Command
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can
- 8.8 High severity
R6700v3: Stack-based Buffer Overflow
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can
- 8.8 High severity
R6700v3: Incorrect Comparison
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloud_control.cgi. The issue
- 8.8 High severity
R6700v3: Improper Certificate Validation
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw e
- 8.8 High severity
R6700v3: Buffer Copy without Checking Size of Input
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of
- 8.8 High severity
R6700v3: Incorrect Authorization
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd servic
- 8.8 High severity
R6700v3: Integer Overflow or Wraparound
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB modu
- 8.8 High severity
Orbi Router RBR750: Hidden Functionality
A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulne
- 8.8 High severity
Orbi Router RBR750: Improper Neutralization of Special Elements used in an OS Command
A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vul
- 7.2 High severity
Orbi Satellite RBS750: Hidden Functionality
A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to
- 7.5 High severity
NETGEAR Nighthawk WiFi6 Router (RAX30): Allocation of Resources Without Limits or Throttling
Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself. A sufficiently large file will cause devic
- 8.8 High severity
NETGEAR Nighthawk WiFi6 Router (RAX30): Unrestricted Upload of File with Dangerous Type
When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complete and bypass certain validation checks. End users can use this to upload modified, unofficial, and po
- 9.8 Critical severity
Netgear RAX30 (AX2400): Improper Authentication
Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin password.
- 9.8 Critical severity
NETGEAR Nighthawk WiFi6 Router: Buffer Copy without Checking Size of Input
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device.
- 9.8 Critical severity
NETGEAR Nighthawk WiFi6 Router: Buffer Copy without Checking Size of Input
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute arbitrary code on the device.
- 8.8 High severity
NETGEAR Nighthawk WiFi6 Router: Cross-Site Request Forgery
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly implemented CSRF protections.
- 7.5 High severity
WNDR3700v2: Improper Resource Shutdown or Release
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit ha
- 9.8 Critical severity
WNDR3700v2: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has
- 7.5 High severity
WNDR3700v2: Improper Resource Shutdown or Release
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely.
- 7.5 High severity
ProSAFE 24 Port 10/100 FS726TP: Insufficiently Protected Credentials
An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.
- 9.8 Critical severity
Mr60 Firmware: Out-of-bounds Write
NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affects MR60 before 1.1.7.132, MS60 before 1.1.7.132, R6900P before 1.3.3.154, R7000P before 1.3.3.154, R7960P before 1.4.4.94, and R8000P before
- 7.4 High severity
Wnr612v2 Firmware: Download of Code Without Integrity Check
An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an attacker can conduct a MITM attack to modify the user-upload
- 7.8 High severity
R7000p Firmware: Out-of-bounds Write
Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to contain a pre-authentication stack overflow.
- 9.8 Critical severity
Rax40 Firmware: Buffer Copy without Checking Size of Input
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1.0.2.60, R6400v2 before 1.0.4.122, R6700v3 before 1.0.4.122, R6900P before 1.3.3.152, R7000P before 1.3.3.152, R7000 bef
- 8.1 High severity
Wnr2000 Firmware: Download of Code Without Integrity Check
An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbi
- 7.8 High severity
NETGEAR Nighthawk WiFi6 Router: Improper Neutralization of Special Elements used in an OS Command
The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to exe
- 8.8 High severity
NETGEAR Nighthawk WiFi6 Router: Improper Authentication
A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be changed by a user via any normally accessible means.
- 8.8 High severity
NETGEAR Nighthawk WiFi6 Router: Improper Neutralization of Special Elements used in an OS Command
The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authenticat
- 9.8 Critical severity
R7000 Firmware: Out-of-bounds Write
Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncat
- 9.8 Critical severity
Wnr2000v4 Firmware: Out-of-bounds Write
Netgear N300 wireless router wnr2000v4-V1.0.0.70 is vulnerable to Buffer Overflow via uhttpd. There is a stack overflow vulnerability caused by strcpy.
- 7.8 High severity
R7000 Firmware: Out-of-bounds Write
Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncpy.