CVE-2026-123180: Missing Authentication Vulnerability in NETGEAR Nighthawk RAX30 models

Published Nov 10, 2026

Updated

A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This affects the confidentiality, integrity and availability of the router.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NETGEAR RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router to a version that resolves this vulnerability.
Fixed in v1.0.15.110

Event History

Nov 10, 2026

CVE Published

via MITRE·04:03 PM

Data Sourced

via MITRE·04:03 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

The affected population is NETGEAR Nighthawk RAX30 models. An attacker must be adjacent to the router’s network and authenticated to its Wi-Fi network; the issue does not require authentication to the router’s management interface.

What could an attacker do after exploiting the issue?

An attacker meeting the network-access condition could obtain sensitive information and tamper with device configuration. The reported impact includes exposure or modification of administrator credentials and effects on confidentiality, integrity, and availability.

CVE-2026-123180: Missing Authentication Vulnerability in NETGEAR Nighthawk RAX30 models

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What could an attacker do after exploiting the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What could an attacker do after exploiting the issue?