Executive brief
A configuration management vulnerability affects a wide range of Netgear networking devices, including Orbi systems and Nighthawk routers. An authorized administrator already connected to the local network could exploit this flaw to tamper with system settings beyond their intended permissions. This could lead to unauthorized changes in device behavior or security configurations.
Technical details
The vulnerability is classified as CWE-15 (External Control of System or Configuration Setting) due to insufficient configuration management. An attacker must have high privileges (authenticated administrator) and be located on the adjacent network (local network) to exploit the flaw. Successful exploitation allows the attacker to tamper with system settings, potentially bypassing intended configuration restrictions. The issue affects numerous Netgear product lines including RAX, RBR, and EX series. Netgear has acknowledged the issue, though specific firmware patch versions are not detailed in the NVD record.
Affected products
- Netgear CBR750
- Netgear EX6120
- Netgear EX6130
- Netgear MR60
- Netgear MR70
- Netgear MR80
- Netgear MS60
- Netgear MS70
- Netgear MS80
- Netgear RAX15
- Netgear RAX20
- Netgear RAX200
- Netgear RAX35v2
- Netgear RAX38v2
- Netgear RAX40v2
- Netgear RAX42
- Netgear RAX43
- Netgear RAX45
- Netgear RAX48
- Netgear RAX50
- Netgear RAX50S
- Netgear RAX75
- Netgear RAX80
- Netgear RAXE450
- Netgear RAXE500
- Netgear RBR750
- Netgear RBR840
- Netgear RBR850
- Netgear RBRE960
- Netgear RBS750
- Netgear RBS840
- Netgear RBS850
- Netgear RBSE960
- Netgear RS700
- Netgear XR1000
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://www.netgear.com/support/product/cbr750/
- https://www.netgear.com/support/product/ex6120/
- https://www.netgear.com/support/product/ex6130/
- https://www.netgear.com/support/product/mr60/
- https://www.netgear.com/support/product/mr70/
- https://www.netgear.com/support/product/mr80/
- https://www.netgear.com/support/product/ms60/