CVE-2026-11732

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in NETGEAR Router Block Sites Feature

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Netgear, Inc.

Description

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-11732

EUVD

EUVD-2026-98774

Affected Vendors & Products

Vendor	Product	Version / Range
NETGEAR	CAX30	0
NETGEAR	RAX30	0
NETGEAR	RAX5	0
NETGEAR	RAXE300	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is an insufficient input validation issue in the website blocking feature of certain NETGEAR routers. It allows a network-adjacent attacker with WiFi credentials to execute unauthorized commands on the router. The vulnerability only affects systems where the Block Sites feature is enabled.

Detection Guidance

This vulnerability can only be exploited when the Block Sites feature is enabled on affected NETGEAR routers. To detect it, check if the Block Sites feature is active on your router's admin panel. No specific commands are provided in the context, but you can verify the feature status through the router's web interface or by inspecting network traffic for unauthorized command execution attempts.

Impact Analysis

An attacker could exploit this to run unauthorized commands, potentially compromising the router's confidentiality, integrity, and availability. This may lead to unauthorized access, data breaches, or disruption of network services.

Compliance Impact

This vulnerability could impact compliance with standards like GDPR or HIPAA by compromising the confidentiality, integrity, and availability of the router. Unauthorized command execution may lead to data breaches or unauthorized access, which are critical violations under these regulations.

Mitigation Strategies

Disable the Block Sites feature on your NETGEAR router immediately to prevent exploitation. Check for firmware updates from NETGEAR that address this vulnerability and apply them as soon as possible.

Hi! I’m here to help you understand CVE-2026-11732. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70