{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-11731", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "state": "PUBLISHED", "assignerShortName": "NETGEAR", "dateReserved": "2026-06-09T02:46:39.902Z", "datePublished": "2026-10-13T14:41:42.298Z", "dateUpdated": "2026-10-16T13:58:30.825Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-10-16T13:58:30.825Z" }, "title": "Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models", "datePublic": "2026-10-13T00:00:00.000Z", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-288", "description": "CWE-288 Authentication bypass using an alternate path or channel", "type": "CWE" } ] } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "affected": [ { "vendor": "NETGEAR", "product": "RAX30", "versions": [ { "status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom" } ], "defaultStatus": "unaffected" }, { "vendor": "NETGEAR", "product": "RAX29", "versions": [ { "status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom" } ], "defaultStatus": "unaffected" }, { "vendor": "NETGEAR", "product": "RAX28", "versions": [ { "status": "affected", "version": "0", "lessThan": "v1.0.15.110", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.

" } ] } ], "references": [ { "url": "https://www.netgear.com/support/product/rax30", "tags": [ "product", "patch" ] }, { "url": "https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory", "tags": [ "vendor-advisory", "patch" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/V:D/U:Amber" } }, { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } } ], "solutions": [ { "lang": "en", "value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionRAX28 Nighthawk AX5 5-Stream AX2200 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax28 RAX29 Nighthawk AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax29 RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax30", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:

ProductFixed Version
RAX28 Nighthawk AX5 5-Stream AX2200 WiFi 6 Routerv1.0.15.110
RAX29 Nighthawk AX2400 WiFi 6 Routerv1.0.15.110
RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Routerv1.0.15.110
" } ] } ], "credits": [ { "lang": "en", "value": "Yanming Chen of Guangzhou University", "type": "finder" }, { "lang": "en", "value": "Michael Gentile", "type": "finder" } ], "source": { "discovery": "EXTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.3" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-10-13T00:00:00+00:00", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-11731" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T03:59:11.952Z" } } ] } }