CVE-2026-11739: Command injection vulnerability in some NETGEAR Nighthawk devices
A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NETGEAR Nighthawk MR60 / MS60to a version that resolves this vulnerability.Fixed in V1.1.8.142 - Upgrade
Upgrade
NETGEAR Nighthawk MR70 / MS70to a version that resolves this vulnerability.Fixed in V1.0.4.48 - Upgrade
Upgrade
NETGEAR Nighthawk MR90 / MS90to a version that resolves this vulnerability.Fixed in V1.0.2.46 - Upgrade
Upgrade
NETGEAR Nighthawk RAX20to a version that resolves this vulnerability.Fixed in V1.0.17.142 - Upgrade
Upgrade
NETGEAR Nighthawk RAX200to a version that resolves this vulnerability.Fixed in V1.0.11.148 - Upgrade
Upgrade
NETGEAR Nighthawk RAX35to a version that resolves this vulnerability.Fixed in V1.0.17.142 - Upgrade
Upgrade
NETGEAR Nighthawk RAX35v2to a version that resolves this vulnerability.Fixed in V1.0.17.142 - Upgrade
Upgrade
NETGEAR Nighthawk RAX41 / RAX41v2 / RAX42 / RAX42v2 / RAX43 / RAX43v2 / RAX45to a version that resolves this vulnerability.Fixed in V1.1.6.36 - Upgrade
Upgrade
NETGEAR Nighthawk RAX45to a version that resolves this vulnerability.Fixed in V1.0.17.142 - Upgrade
Upgrade
NETGEAR Nighthawk RAX49S / RAX50 / RAX50v2 / RAX54S / RAX54Sv2to a version that resolves this vulnerability.Fixed in V1.1.6.36 - Upgrade
Upgrade
NETGEAR Nighthawk RAX80to a version that resolves this vulnerability.Fixed in V1.0.11.148 - Upgrade
Upgrade
NETGEAR Nighthawk RAXE500to a version that resolves this vulnerability.Fixed in V1.2.14.110 - Upgrade
Upgrade
NETGEAR Nighthawk RS700to a version that resolves this vulnerability.Fixed in V1.0.9.6 - Upgrade
Upgrade
NETGEAR Nighthawk XR1000 / XR1000v2to a version that resolves this vulnerability.Fixed in V1.1.0.22 - Compensating control
For models marked (EoS): retire the affected devices and upgrade to a newer NETGEAR device for continued security support (no security updates are planned).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11739?
The severity of CVE-2026-11739 is rated as 55 on the risk scale, indicating a medium level of risk.
How do I fix CVE-2026-11739?
To fix CVE-2026-11739, ensure that your NETGEAR Nighthawk device is updated with the latest firmware provided by NETGEAR.
What devices are affected by CVE-2026-11739?
CVE-2026-11739 affects specific models of NETGEAR Nighthawk devices that have the command injection vulnerability.
Can CVE-2026-11739 be exploited remotely?
CVE-2026-11739 requires an attacker to be network-adjacent, meaning they must be on the local network to exploit the vulnerability.
What are the consequences of CVE-2026-11739?
Exploitation of CVE-2026-11739 can lead to the compromise of the confidentiality and integrity of the affected NETGEAR Nighthawk device.