CVE-2026-11814

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.
References
Link Resource
https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory Vendor Advisory
https://www.netgear.com/support/product/be9300/ Product
https://www.netgear.com/support/product/mr60/ Product
https://www.netgear.com/support/product/ms60/ Product
https://www.netgear.com/support/product/r6700ax/ Product
https://www.netgear.com/support/product/rax10/ Product
https://www.netgear.com/support/product/rax120/ Product
https://www.netgear.com/support/product/rax120v2/ Product
https://www.netgear.com/support/product/rax20/ Product
https://www.netgear.com/support/product/rax28/ Product
https://www.netgear.com/support/product/rax29/ Product
https://www.netgear.com/support/product/rax30/ Product
https://www.netgear.com/support/product/rax36s/ Product
https://www.netgear.com/support/product/rax43/ Product
https://www.netgear.com/support/product/rax45/ Product
https://www.netgear.com/support/product/rax50/ Product
https://www.netgear.com/support/product/rax70/ Product
https://www.netgear.com/support/product/rbr760/ Product
https://www.netgear.com/support/product/rbs760/ Product
https://www.netgear.com/support/product/rs100/ Product
https://www.netgear.com/support/product/rs200/ Product
https://www.netgear.com/support/product/rs280/ Product
https://www.netgear.com/support/product/rs300/ Product
https://www.netgear.com/support/product/rs500/ Product
https://www.netgear.com/support/product/rs600/ Product
https://www.netgear.com/support/product/rs70/ Product
https://www.netgear.com/support/product/rs90/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:netgear:be9300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:be9300:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netgear:mr60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:mr60:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netgear:ms60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ms60:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netgear:r6700ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r6700ax:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netgear:rax10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax10:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netgear:rax120_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax120:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netgear:rax120v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax120v2:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netgear:rax20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax20:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netgear:rax28_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax28:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netgear:rax29_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax29:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:netgear:rax36s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax36s:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:netgear:rax43_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax43:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:netgear:rax45_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax45:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:netgear:rax50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax50:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:netgear:rax70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax70:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:netgear:rbr760_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbr760:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:netgear:rbs760_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbs760:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:netgear:rs100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs100:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:netgear:rs200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs200:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:netgear:rs280_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs280:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:netgear:rs300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs300:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:netgear:rs500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs500:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:netgear:rs600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs600:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:netgear:rs70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs70:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:netgear:rs90_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rs90:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-08-11 16:17

Updated : 2026-09-09 03:00


NVD link : CVE-2026-11814

Mitre link : CVE-2026-11814

CVE.ORG link : CVE-2026-11814


JSON object : View

Products Affected

netgear

  • rbr760_firmware
  • rax10_firmware
  • rax120v2
  • rax29
  • r6700ax_firmware
  • ms60_firmware
  • rax43
  • rs100
  • mr60
  • be9300
  • rs500_firmware
  • rs90
  • rax120
  • rs600_firmware
  • ms60
  • rax70
  • rax50
  • rax70_firmware
  • rax45
  • rs200
  • rs280_firmware
  • rax120v2_firmware
  • rax43_firmware
  • rs70_firmware
  • rax30
  • rax120_firmware
  • rs280
  • rbs760
  • rax10
  • rax36s_firmware
  • rbr760
  • rs90_firmware
  • rax28_firmware
  • rax29_firmware
  • rax28
  • rs70
  • be9300_firmware
  • rs500
  • rax45_firmware
  • rs300_firmware
  • rbs760_firmware
  • r6700ax
  • rs200_firmware
  • rs600
  • mr60_firmware
  • rax50_firmware
  • rax30_firmware
  • rs300
  • rax20
  • rax36s
  • rs100_firmware
  • rax20_firmware
CWE
CWE-295

Improper Certificate Validation

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')