CVE-2026-11737: NETGEAR RAX20 Firmware

Medium severity, CVSS 4.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.

Affected products

NETGEAR RAX20 Firmware: before 1.0.18.144 (fixed in 1.0.18.144)
NETGEAR RAX41 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX41V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX42 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX42V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX43 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX43V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX45 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX49S Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX50 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX50V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX54S Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX54SV2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)

Published 2026-08-11. Last modified 2026-09-09.