CVE-2026-11739

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in NETGEAR Nighthawk Router

Publication date: 2026-08-11

Last updated on: 2026-09-09

Assigner: Netgear, Inc.

Description

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-09-09

Generated

2026-09-21

AI Q&A

2026-08-11

EPSS Evaluated

2026-09-20

NVD

CVE-2026-11739

EUVD

EUVD-2026-56192

Affected Vendors & Products

Vendor	Product	Version / Range
netgear	ms90_firmware	to 1.0.2.46 (exc)
netgear	rax20_firmware	to 1.0.17.142 (exc)
netgear	rax200_firmware	to 1.0.11.148 (exc)
netgear	rax35_firmware	to 1.0.17.142 (exc)
netgear	rax35v2_firmware	to 1.0.17.142 (exc)
netgear	rax41_firmware	to 1.1.6.36 (exc)
netgear	rax41v2_firmware	to 1.1.6.36 (exc)
netgear	rax42_firmware	to 1.1.6.36 (exc)
netgear	rax42v2_firmware	to 1.1.6.36 (exc)
netgear	rax43_firmware	to 1.1.6.36 (exc)
netgear	rax43v2_firmware	to 1.1.6.36 (exc)
netgear	rax45_firmware	to 1.0.17.142 (exc)
netgear	rax49s_firmware	to 1.1.6.36 (exc)
netgear	rax50_firmware	to 1.1.6.36 (exc)
netgear	rax50v2_firmware	to 1.1.6.36 (exc)
netgear	rax54s_firmware	to 1.1.6.36 (exc)
netgear	rax54sv2_firmware	to 1.1.6.36 (exc)
netgear	rax80_firmware	to 1.0.11.148 (exc)
netgear	raxe500_firmware	to 1.2.14.110 (exc)
netgear	rs700_firmware	to 1.0.9.6 (exc)
netgear	xr1000_firmware	to 1.1.0.22 (exc)
netgear	xr1000v2_firmware	to 1.1.0.22 (exc)
netgear	mr60_firmware	to 1.1.8.142 (exc)
netgear	mr70_firmware	to 1.0.4.48 (exc)
netgear	mr90_firmware	to 1.0.2.46 (exc)
netgear	ms60_firmware	to 1.1.8.142 (exc)
netgear	ms70_firmware	to 1.0.4.48 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in certain NETGEAR Nighthawk devices. It allows an attacker within the local network to intercept and modify traffic, potentially compromising the device's confidentiality and integrity.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual network traffic or unauthorized device access. Check for unexpected command execution logs or modified configurations on NETGEAR Nighthawk devices. Use network sniffing tools like tcpdump or Wireshark to inspect traffic for suspicious patterns.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the device, steal sensitive data, or alter its settings. Since the attacker needs to be on the local network, home or small business networks are more likely to be affected.

Compliance Impact

This vulnerability could potentially compromise the confidentiality and integrity of affected devices, which may lead to unauthorized access to sensitive data. This could impact compliance with standards like GDPR and HIPAA, which require protection of personal and health information respectively.

Mitigation Strategies

Isolate affected NETGEAR Nighthawk devices from untrusted networks. Apply firmware updates if available. Monitor network traffic for signs of interception or modification. Disable unnecessary services and restrict access to device interfaces.

Hi! I’m here to help you understand CVE-2026-11739. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70