CVE-2026-0412: Insufficient input validation vulnerability in NETGEAR JR6150 Web UI
Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows administrators connected to the local network to make unauthorized modification of router software and functionality. NETGEAR JR6150 reached End-of-Support status in 2018 and is no longer receiving security updates. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.
This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit)from your environment.Retire End-of-Support JR6150 devices and replace them with newer NETGEAR models to ensure continued security support and updates, since JR6150 is no longer receiving security updates.
- Configuration
Enable automatic updates on the device so patches (if available) are applied automatically.
NETGEAR JR6150 firmware automatic_updates = enabled - Compensating control
If immediate update or replacement is not possible, restrict administrative access to the device: disable remote/remote-web management, limit management interface access to trusted IPs or a management VLAN, isolate the router from untrusted local networks, and apply firewall rules to block unnecessary access.
- Operational
Check the device firmware version and update it to the latest available firmware if the device does not already have the patch applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0412?
CVE-2026-0412 has a medium severity rating of 4.3.
What does CVE-2026-0412 vulnerability entail?
CVE-2026-0412 involves insufficient input validation in the NETGEAR JR6150 Web UI, allowing unauthorized modifications of router software.
How do I fix CVE-2026-0412?
To fix CVE-2026-0412, check the firmware version of your NETGEAR JR6150 and update it to the latest available.
Is my NETGEAR JR6150 device affected by CVE-2026-0412?
Yes, the NETGEAR JR6150 device is affected by CVE-2026-0412 due to insufficient input validation.
What is the status of support for devices affected by CVE-2026-0412?
The NETGEAR JR6150 has reached End-of-Support status, meaning no further updates are provided.