CVE-2026-11739: NETGEAR MR60 Firmware

Medium severity, CVSS 6.4. EPSS: 1.1% chance of exploitation in the next 30 days.

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Affected products

NETGEAR MR60 Firmware: before 1.1.8.142 (fixed in 1.1.8.142)
NETGEAR MR70 Firmware: before 1.0.4.48 (fixed in 1.0.4.48)
NETGEAR MR90 Firmware: before 1.0.2.46 (fixed in 1.0.2.46)
NETGEAR MS60 Firmware: before 1.1.8.142 (fixed in 1.1.8.142)
NETGEAR MS70 Firmware: before 1.0.4.48 (fixed in 1.0.4.48)
NETGEAR MS90 Firmware: before 1.0.2.46 (fixed in 1.0.2.46)
NETGEAR RAX200 Firmware: before 1.0.11.148 (fixed in 1.0.11.148)
NETGEAR RAX20 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX35 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX35V2 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX41 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX41V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX42 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX42V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX43 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX43V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX45 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX49S Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX50 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX50V2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX54S Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX54SV2 Firmware: before 1.1.6.36 (fixed in 1.1.6.36)
NETGEAR RAX80 Firmware: before 1.0.11.148 (fixed in 1.0.11.148)
NETGEAR RAXE500 Firmware: before 1.2.14.110 (fixed in 1.2.14.110)
NETGEAR RS700 Firmware: before 1.0.9.6 (fixed in 1.0.9.6)
and 2 more

Published 2026-08-11. Last modified 2026-09-09.