CVE-2026-11730: Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models

Published Oct 13, 2026

Updated

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Affected Software

1 affected component

Netgear EX Series Extenders

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NETGEAR EX3700 to a version that resolves this vulnerability.
Fixed in V1.0.0.102
Upgrade
Upgrade NETGEAR EX6120 to a version that resolves this vulnerability.
Fixed in V1.0.1.74

Event History

Oct 13, 2026

CVE Published

via MITRE·02:38 PM

Data Sourced

via MITRE·02:38 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Event

via NVD·05:44 PM

Frequently Asked Questions

Who is realistically exposed to this issue?

NETGEAR EX Series Extenders are exposed when an attacker can access the same network, for example by obtaining WiFi credentials. The affected products specifically include the EX3700 and EX6120 support references provided.

What does an attacker need to exploit the vulnerability?

The attacker needs network-adjacent access and must be able to predict valid session identifiers. Successful exploitation allows hijacking an authenticated administrator session on the web management portal.