CVE-2026-11814: NETGEAR BE9300 Firmware

Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days.

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.

Affected products

NETGEAR BE9300 Firmware: before 1.0.1.84 (fixed in 1.0.1.84)
NETGEAR MR60 Firmware: before 1.1.8.142 (fixed in 1.1.8.142)
NETGEAR MS60 Firmware: before 1.1.8.142 (fixed in 1.1.8.142)
NETGEAR r6700ax Firmware: before 1.0.18.164 (fixed in 1.0.18.164)
NETGEAR RAX10 Firmware: before 1.0.5.50 (fixed in 1.0.5.50)
NETGEAR RAX120 Firmware: before 1.2.10.56 (fixed in 1.2.10.56)
NETGEAR RAX120V2 Firmware: before 1.2.10.56 (fixed in 1.2.10.56)
NETGEAR RAX20 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX28 Firmware: before 1.0.14.108 (fixed in 1.0.14.108)
NETGEAR RAX29 Firmware: before 1.0.14.108 (fixed in 1.0.14.108)
NETGEAR RAX30 Firmware: before 1.0.14.108 (fixed in 1.0.14.108)
NETGEAR RAX36S Firmware: before 1.0.5.50 (fixed in 1.0.5.50)
NETGEAR RAX43 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX45 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX50 Firmware: before 1.0.17.142 (fixed in 1.0.17.142)
NETGEAR RAX70 Firmware: before 1.0.19.172 (fixed in 1.0.19.172)
NETGEAR RBR760 Firmware: before 6.3.8.11 (fixed in 6.3.8.11)
NETGEAR RBS760 Firmware: before 6.3.8.11 (fixed in 6.3.8.11)
NETGEAR RS100 Firmware: before 1.0.1.80 (fixed in 1.0.1.80)
NETGEAR RS200 Firmware: before 1.0.1.90 (fixed in 1.0.1.90)
NETGEAR RS280 Firmware: before 1.0.1.90 (fixed in 1.0.1.90)
NETGEAR RS300 Firmware: before 1.0.1.90 (fixed in 1.0.1.90)
NETGEAR RS500 Firmware: before 1.0.1.90 (fixed in 1.0.1.90)
NETGEAR RS600 Firmware: before 1.0.1.90 (fixed in 1.0.1.90)
NETGEAR RS70 Firmware: before 1.0.1.80 (fixed in 1.0.1.80)
and 1 more

Published 2026-08-11. Last modified 2026-09-09.