Medium · published August 11, 2026
A command injection vulnerability in certain affected NETGEAR Nighthawk
devices allows a network-adjacent attacker with the ability to intercept
and modify local network traffic (attacker in the middle) to compromise
the confidentiality and integrity of the affected device.
| Product | Versions | Fixed in |
|---|---|---|
| netgear/ms90_firmware | < 1.0.2.46 | 1.0.2.46 |
| netgear/rax20_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear/rax42_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax42v2_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax43_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax43v2_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax45_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear/rax49s_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax50_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax50v2_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax200_firmware | < 1.0.11.148 | 1.0.11.148 |
| netgear/rax35_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear/rax35v2_firmware | < 1.0.17.142 | 1.0.17.142 |
| netgear/rax41_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax41v2_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax54s_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax54sv2_firmware | < 1.1.6.36 | 1.1.6.36 |
| netgear/rax80_firmware | < 1.0.11.148 | 1.0.11.148 |
| netgear/raxe500_firmware | < 1.2.14.110 | 1.2.14.110 |
| netgear/rs700_firmware | < 1.0.9.6 | 1.0.9.6 |
| netgear/xr1000_firmware | < 1.1.0.22 | 1.1.0.22 |
| netgear/xr1000v2_firmware | < 1.1.0.22 | 1.1.0.22 |
| netgear/mr60_firmware | < 1.1.8.142 | 1.1.8.142 |
| netgear/mr70_firmware | < 1.0.4.48 | 1.0.4.48 |
| netgear/mr90_firmware | < 1.0.2.46 | 1.0.2.46 |
| netgear/ms60_firmware | < 1.1.8.142 | 1.1.8.142 |
| netgear/ms70_firmware | < 1.0.4.48 | 1.0.4.48 |