{"affected":[{"defaultStatus":"unaffected","product":"CAX30","source":"CNA: NETGEAR","vendor":"NETGEAR","versions":[{"lessThan":"V2.3.4.12","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"RAX30","source":"CNA: NETGEAR","vendor":"NETGEAR","versions":[{"lessThan":"V1.0.14.108","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"RAX5","source":"CNA: NETGEAR","vendor":"NETGEAR","versions":[{"lessThan":"V1.0.5.34","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"RAXE300","source":"CNA: NETGEAR","vendor":"NETGEAR","versions":[{"lessThan":"V1.0.10.72","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-11732","cwes":["CWE-20"],"description":"An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.","epss":{"date":"2026-11-12","percentile":0.15348,"score":0.00241},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: NETGEAR","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber","version":"4.0"},{"score":8.8,"severity":"high","source":"CNA: NETGEAR","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794552183326,"publishedAt":1791902570698,"references":[{"source":"CNA: NETGEAR","tags":["product","patch"],"url":"https://www.netgear.com/support/product/cax30/"},{"source":"CNA: NETGEAR","tags":["product","patch"],"url":"https://www.netgear.com/support/product/rax5/"},{"source":"CNA: NETGEAR","tags":["product","patch"],"url":"https://www.netgear.com/support/product/rax30/"},{"source":"CNA: NETGEAR","tags":["product","patch"],"url":"https://www.netgear.com/support/product/raxe300/"},{"source":"CNA: NETGEAR","tags":["vendor-advisory","patch"],"url":"https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory"}],"remediation":[{"kind":"fix","source":"CNA: NETGEAR","text":"Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionCAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router\n\n\n\n V2.3.4.12 https://www.netgear.com/support/product/cax30/ \n\n\n\n\n\n\nRAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router\n\n\n\n V1.0.14.108 https://www.netgear.com/support/product/rax30/ \n\n\n\n\n\n\nRAX5 4-Stream AX1600 WiFi 6 Router V1.0.5.34 https://www.netgear.com/support/product/rax5/ RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router V1.0.10.72 https://www.netgear.com/support/product/raxe300/ \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support."},{"kind":"fix","source":"CNA: NETGEAR","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.netgear.com/support/product/cax30/"},{"kind":"fix","source":"CNA: NETGEAR","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.netgear.com/support/product/rax5/"},{"kind":"fix","source":"CNA: NETGEAR","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.netgear.com/support/product/rax30/"},{"kind":"fix","source":"CNA: NETGEAR","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.netgear.com/support/product/raxe300/"},{"kind":"fix","source":"CNA: NETGEAR","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory"}],"revision":"8a094bba2af7d52e6216e32160f99ef5cdbac5d1a935476b2ff34488b6575dd1","sources":[{"modifiedAt":1794552183326,"name":"CNA: NETGEAR","retrievedAt":1794553702618,"url":"https://www.cve.org/CVERecord?id=CVE-2026-11732"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794553728593,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11732"}],"ssvc":{"assessedAt":1791849600000,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"An insufficient input validation vulnerability exists in the website blocking feature of certain NETGEAR RAX/CAX series models","updatedAt":1794553728593}