CVE-2023-36187: NETGEAR CBR40 Firmware

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to httpd.

Affected products

• NETGEAR CBR40 Firmware: before 2.5.0.24 (fixed in 2.5.0.24)
• NETGEAR LAX20 Firmware: before 1.1.6.34 (fixed in 1.1.6.34)
• NETGEAR MK62 Firmware: before 1.1.6.122 (fixed in 1.1.6.122)
• NETGEAR MR60 Firmware: before 1.1.6.122 (fixed in 1.1.6.122)
• NETGEAR MS60 Firmware: before 1.1.6.122 (fixed in 1.1.6.122)
• NETGEAR r6400 Firmware: before 1.0.1.70 (fixed in 1.0.1.70)
• NETGEAR r6400v2 Firmware: before 1.0.4.118 (fixed in 1.0.4.118)
• NETGEAR r6700v3 Firmware: before 1.0.4.118 (fixed in 1.0.4.118)
• NETGEAR r7000 Firmware: before 1.0.11.130 (fixed in 1.0.11.130)
• NETGEAR r7000p Firmware: before 1.3.3.148 (fixed in 1.3.3.148)
• NETGEAR RAX200 Firmware: before 1.0.4.120 (fixed in 1.0.4.120)
• NETGEAR RAX75 Firmware: before 1.0.4.120 (fixed in 1.0.4.120)
• NETGEAR RAX80 Firmware: before 1.0.4.120 (fixed in 1.0.4.120)
• NETGEAR RBW30 Firmware: before 2.6.2.6 (fixed in 2.6.2.6)
• NETGEAR RS400 Firmware: before 1.5.1.86 (fixed in 1.5.1.86)

Published 2023-09-01. Last modified 2026-06-17.