NETGEAR MR90 Firmware vulnerabilities

3 CVEs affecting NETGEAR MR90 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11739, published 2026-08-11.

More from NETGEAR.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-11739, published 2026-08-11. Medium severity, CVSS 6.4. EPSS: 1.1% chance of exploitation in the next 30 days. A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the…
• CVE-2026-11734, published 2026-08-11. Low severity, CVSS 2.7. EPSS: 0.6% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.
• CVE-2025-12946, published 2025-12-09. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle…