CVE-2026-11730CWE-335

CVE-2026-11730

Medium · published October 13, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
4.5 · CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-335 · Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Published
2026-10-13T19:17Z
References (3)
https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory · a2826606-91e7-4eb6-899e-8484bd4575d5https://www.netgear.com/support/product/ex3700 · a2826606-91e7-4eb6-899e-8484bd4575d5https://www.netgear.com/support/product/ex6120 · a2826606-91e7-4eb6-899e-8484bd4575d5
EPSS history
Timeline
  • 15 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 13 OCT 14:38Z
    Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models
    cvelistv5
  • 13 OCT 14:38Z
    Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models
    cvelistv5