VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/11xxx/CVE-2026-11732.json
T

269 lines
13 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-11732",
"assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"state": "PUBLISHED",
"assignerShortName": "NETGEAR",
"dateReserved": "2026-06-09T02:46:41.216Z",
"datePublished": "2026-10-13T14:42:50.698Z",
"dateUpdated": "2026-11-13T06:43:03.326Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"shortName": "NETGEAR",
"dateUpdated": "2026-11-13T06:43:03.326Z"
},
"title": "An insufficient input validation vulnerability exists in the website blocking feature of certain NETGEAR RAX/CAX series models",
"datePublic": "2026-10-13T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"affected": [
{
"vendor": "NETGEAR",
"product": "CAX30",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V2.3.4.12",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NETGEAR",
"product": "RAX30",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V1.0.14.108",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NETGEAR",
"product": "RAX5",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V1.0.5.34",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NETGEAR",
"product": "RAXE300",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V1.0.10.72",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.</p>"
}
]
}
],
"references": [
{
"url": "https://www.netgear.com/support/product/cax30/",
"tags": [
"product",
"patch"
]
},
{
"url": "https://www.netgear.com/support/product/rax5/",
"tags": [
"product",
"patch"
]
},
{
"url": "https://www.netgear.com/support/product/rax30/",
"tags": [
"product",
"patch"
]
},
{
"url": "https://www.netgear.com/support/product/raxe300/",
"tags": [
"product",
"patch"
]
},
{
"url": "https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory",
"tags": [
"vendor-advisory",
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "LOW",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.3,
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionCAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router\n\n\n\n V2.3.4.12 https://www.netgear.com/support/product/cax30/ \n\n\n\n\n\n\nRAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router\n\n\n\n V1.0.14.108 https://www.netgear.com/support/product/rax30/ \n\n\n\n\n\n\nRAX5 4-Stream AX1600 WiFi 6 Router V1.0.5.34 https://www.netgear.com/support/product/rax5/ RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router V1.0.10.72 https://www.netgear.com/support/product/raxe300/ \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>CAX30</b> Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router</td><td>\n\n<p><a href=\"https://www.netgear.com/support/product/cax30/\"><span>V2.3.4.12</span></a></p>\n\n\n\n\n</td></tr><tr><td><b>RAX30</b> Nighthawk AX5 5-Stream AX2400 WiFi 6 Router</td><td>\n\n<p><a href=\"https://www.netgear.com/support/product/rax30/\">V1.0.14.108</a></p>\n\n\n\n\n</td></tr><tr><td><b>RAX5</b>&nbsp;4-Stream AX1600 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax5/\">V1.0.5.34</a></td></tr><tr><td><b>RAXE300</b> Nighthawk AXE7800 Tri-Band WiFi 6E Router</td><td><a href=\"https://www.netgear.com/support/product/raxe300/\">V1.0.10.72</a></td></tr></tbody></table><p>Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.</p>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "kaoken",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-10-13T00:00:00+00:00",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3",
"id": "CVE-2026-11732"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-10-14T03:59:09.756Z"
}
}
]
}
}
View Git Blame Copy Permalink