NETGEAR RAX120V2 Firmware vulnerabilities

9 CVEs affecting NETGEAR RAX120V2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11814, published 2026-08-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-40619, published 2026-01-28. High severity, CVSS 7.7. EPSS: 2.5% chance of exploitation in the next 30 days. FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to…
CVE-2021-45619, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects EX6200v2 before 1.0.1.86, EX6250 before 1.0.0.134, EX7700 before 1.0.0.216, EX8000 before…
CVE-2021-45642, published 2021-12-26. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.64, EX6250 before 1.0.0.134, EX7700 before 1.0.0.222, LBR20 before 2.6.3.50,…
CVE-2026-11814, published 2026-08-11. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise…
CVE-2021-45602, published 2021-12-26. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 before 1.0.0.90, WN3000RPv3 before…
CVE-2021-45603, published 2021-12-26. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by disclosure of sensitive information. A UPnP request reveals a device's serial number, which can be used for a password reset. This affects D7800 before…
CVE-2021-34947, published 2024-05-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR…
CVE-2022-40620, published 2026-01-28. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update packages through its auto-update mechanism.…
CVE-2026-11738, published 2026-08-11. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and…