NETGEAR's Product Security Team has assessed the following product vulnerabilities and provided guidance to address these vulnerabilities in the table below.
Because firmware updates contain security fixes, bug fixes, and new features for your products, we strongly advise you to enable automatic firmware updates on supported devices. For older products, we advise you to download and install new firmware updates as soon as possible or follow the guidance provided for devices that require other remediation steps.
A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.
Severity: MEDIUM
Acknowledgments: fluorescent
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| MR70 Nighthawk Mesh WiFi 6 Router | V1.0.4.48 |
| MS70 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.0.4.48 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.2.14.114 |
| XR1000 Nighthawk WiFi 6 Pro Gaming Router | V1.0.2.86 |
Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.
Severity: MEDIUM
Acknowledgments: ZeroZenx Labs
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| LBR1020 (EoS) Orbi 4GX AC1200 Dual-Band Mesh WiFi Router | V2.6.4.60 |
| LBR20 Orbi LTE Tri-band WiFi Router | V2.7.6.8 |
| R6700AX (EoS) 4-Stream AX1800 WiFi 6 Router | EOS |
| R7800 (EoS) Nighthawk X4S AC2600 Smart WiFi Router | V1.0.4.96 |
| R9000 (EoS) Nighthawk X10 AD7200 Smart WiFi Router | V1.0.6.46 |
| RAX10 4-Stream AX1800 WiFi 6 Router | V1.0.5.50 |
| RAX120 (EoS) Nighthawk AX12 12-Stream WiFi Router | V1.2.10.56 |
| RAX120v1 (EoS) | V1.2.10.56 |
| RAX120v2 Nighthawk AX12 12-Stream AX6000 WiFi Router | V1.2.10.56 |
| RAX36S Nighthawk AX4 4-Stream AX3000 WiFi Router | V1.0.5.50 |
| RAX70 Nighthawk Tri-band AX8 8-Stream AX6600 WiFi 6 Router | V1.0.19.172 |
| RAX78 Nighthawk AX8 8-Stream AX6200 Tri-Band WiFi Router | V1.0.19.172 |
| RBR10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi Router | EOS |
| RBR20 (EoS) Orbi AC2200 Tri-band WiFi Router | EOS |
| RBR350 Orbi AX1800 WiFi 6 Dual-band Mesh Router | V4.4.2.1 |
| RBR40 (EoS) Orbi AC2200 Tri-band WiFi Router | EOS |
| RBR50 (EoS) Orbi AC3000 Tri-band WiFi Router | EOS |
| RBS10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi Add-on Satellite | EOS |
| RBS20 (EoS) Orbi AC2200 Tri-band WiFi Add-on Satellite | EOS |
| RBS350 Orbi AX1800 WiFi 6 Dual-band Mesh Add-on Satellite | V4.4.2.1 |
| RBS40 (EoS) Orbi AC2200 Tri-band WiFi Add-on Satellite | EOS |
| RBS50 (EoS) Orbi AC3000 Tri-band WiFi Add-on Satellite | EOS |
| XR450 (EoS) Nighthawk Pro Gaming Router | V2.3.3.136 |
| XR500 (EoS) Nighthawk Pro Gaming Router | v2.3.3.136 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Severity: MEDIUM
Acknowledgments: kaoken
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| CAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router | V2.2.1.4 |
| RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router | V1.0.10.94 |
| RAX5 4-Stream AX1600 WiFi 6 Router | V1.0.5.34 |
| RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router | V1.0.10.72 |
Severity: MEDIUM
Acknowledgments: fxc233
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RBE970 Orbi Quad-band Mesh WiFi 7 Add-on Satellite | V9.10.1.4 |
| RBE971 Orbi Quad-band Mesh WiFi 7 Router | V9.10.1.4 |
| RBR860 Orbi Tri-band Mesh WiFi 6 Router – 860 Series | V7.2.7.15 |
| RBRE950 Orbi Quad-band Mesh WiFi 6E Router | v7.2.7.15 |
| RBRE960 Orbi Quad-band Mesh WiFi 6E Router | V7.2.7.15 |
| RBS860 Orbi Tri-band Mesh WiFi 6 Add-on Satellite – 860 Series | V7.2.7.15 |
| RBSE950 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | v7.2.7.15 |
| RBSE960 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | V7.2.7.15 |
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
Severity: MEDIUM
Acknowledgments: pjqwudi
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| EX3700 AC750 WiFi Range Extender Essentials Edition | V1.0.0.100 |
| EX3800 (EoS) AC750 WiFi Range Extender Essentials Edition | V1.0.0.100 |
| EX6120 AC1200 Dual Band WiFi Range Extender | V1.0.0.72 |
| EX6130 AC1200 WiFi Range Extender | V1.0.0.54 |
| MR60 Nighthawk Mesh WiFi 6 Router | V1.1.7.132 |
| MR70 Nighthawk Mesh WiFi 6 Router | V1.0.3.28 |
| MR80 Nighthawk Tri-band Mesh WiFi 6 Router | V1.1.7.14 |
| MS60 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.1.7.132 |
| MS70 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.0.3.28 |
| MS80 Nighthawk Tri-band Mesh WiFi 6 Add-on Satellite | V1.1.7.14 |
| R6400v2 (EoS) AC1750 Smart WiFi Router 802.11ac Dual Band Gigabit | V1.0.4.128 |
| R6700v3 (EoS) Nighthawk AC1750 Smart WiFi Dual Band Gigabit Router | V1.0.4.128 |
| R6900P (EoS) Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router | V1.3.3.152 |
| R7000 (EoS) Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router | V1.0.11.216 |
| R7000P (EoS) Nighthawk AC2300 Smart WiFi Dual Band Gigabit Router | V1.3.3.152 |
| R7960P (EoS) Nighthawk X6S AC3600 Tri-Band WiFi Router | V1.4.4.92 |
| R8000P (EoS) Nighthawk X6S AC4000 Tri Band WiFi Router | V1.4.4.92 |
| R8500 (EoS) Nighthawk X8 AC5300 Smart WiFi Router | EOS |
| RAX20 (EoS) 4-Stream AX1800 WiFi 6 Router | V1.0.18.144 |
| RAX35v2 Nighthawk AX4 4-Stream AX3000 WiFi 6 Router | V1.0.12.118 |
| RAX40v2 Nighthawk AX4 4-Stream WiFi Router | V1.0.12.118 |
| RAX41 (EoS) Nighthawk AX5 5-Stream AX3600 WiFi Router | V1.0.12.118 |
| RAX42 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.12.118 |
| RAX43 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.12.120 |
| RAX45 (EoS) Nighthawk AX6 6-Stream AX4300 WiFi Router | V1.0.12.118 |
| RAX48 Nighthawk AX6 6-Stream AX5200 WiFi 6 Router | V1.0.12.118 |
| RAX50 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.12.120 |
| RAX50S Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.12.120 |
| RAXE450 Nighthawk AXE10000 Tri-Band WiFi 6E Router | V1.0.10.86 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.0.10.86 |
| XR1000 Nighthawk WiFi 6 Pro Gaming Router | V1.0.0.68 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet to run commands on your device when the device administrator performs certain specific management actions. This issue affects NETGEAR Orbi 370 series devices before V12.1.2.7.
Severity: MEDIUM
Acknowledgments: ChinaNuke
Affected Products
Recommendation
NETGEAR strongly recommends that you install the latest firmware as soon as possible.
Issue fixed in:
| Product | Fixed Version |
|---|---|
| NETGEAR Orbi 370 series (RBE370, RBE371, RBE372, RBE374) | V12.1.2.7 |
An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle (MiTM) style attacks impacting the product's confidentiality. This vulnerability affects the listed NETGEAR models.
Severity: MEDIUM
Acknowledgments: talsonor
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RAX120v1 (EoS) | V1.2.9.52 |
| RAX120v2 Nighthawk AX12 12-Stream AX6000 WiFi Router | V1.2.9.52 |
| RAX35 (EoS) Nighthawk AX4 4-Stream WiFi 6 Router | V1.0.6.106 |
| RAX38 (EoS) Nighthawk AX4 4-Stream AX3000 WiFi Router | V1.0.6.106 |
| RAX40 (EoS) Nighthawk AX4 4-Stream WiFi Router | V1.0.6.106 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no further security updates are planned. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.
This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.
Severity: MEDIUM
Acknowledgments: Security Research Center (SRC) @ Concordia University
Affected Products
Recommendation
NETGEAR JR6150 has reached End-of-Support phase, and no further security updates are planned. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.
| Product | Fixed Version |
|---|---|
| JR6150 (EoS) AC750 WiFi Router 802.11ac Dual Band Gigabit | EOS |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Severity: MEDIUM
Acknowledgments: byte_blaster
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| CBR750 Orbi WiFi 6 DOCSIS 3.1 Mesh WiFi Cable Modem Router | v4.6.14.4 |
| EX6120 (EoS) AC1200 Dual Band WiFi Range Extender | EOS |
| EX6130 (EoS) AC1200 WiFi Range Extender | EOS |
| MR60 Nighthawk Mesh WiFi 6 Router | V1.1.7.128 |
| MR70 Nighthawk Mesh WiFi 6 Router | V1.0.3.28 |
| MR80 Nighthawk Tri-band Mesh WiFi 6 Router | V1.1.7.6 |
| MS60 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.1.7.128 |
| MS70 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.0.3.28 |
| MS80 Nighthawk Tri-band Mesh WiFi 6 Add-on Satellite | V1.1.7.6 |
| RAX15(EoS) 4-Stream AX1800 WiFi 6 Router | EOS |
| RAX20 (EoS) 4-Stream AX1800 WiFi 6 Router | EOS |
| RAX200 (EoS) Nighthawk Tri-Band AX12 12-Stream WiFi Router | EOS |
| RAX35v2 Nighthawk AX4 4-Stream AX3000 WiFi 6 Router | V1.0.11.112 |
| RAX38v2 Nighthawk AX4 4-Stream AX3000 WiFi Router | V1.0.11.112 |
| RAX40v2 Nighthawk AX4 4-Stream WiFi Router | V1.0.11.112 |
| RAX42 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.11.112 |
| RAX43 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.11.112 |
| RAX45 (EoS) Nighthawk AX6 6-Stream AX4300 WiFi Router | V1.0.11.112 |
| RAX48 Nighthawk AX6 6-Stream AX5200 WiFi 6 Router | V1.0.11.112 |
| RAX50 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.11.112 |
| RAX50S Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.11.112 |
| RAX75 (EoS) Nighthawk AX8 8-Stream AX5700 WiFi 6 Router | EOS |
| RAX80 (EoS) Nighthawk AX8 8-Stream WiFi Router | EOS |
| RAXE450 Nighthawk AXE10000 Tri-Band WiFi 6E Router | V1.0.10.86 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.0.10.86 |
| RBR750 Orbi WiFi 6 Router AX4200 | V4.6.14.3 |
| RBR840 (EoS) Orbi WiFi 6 System AX5700 | V4.6.14.3 |
| RBR850 Orbi WiFi 6 Router AX6000 | V4.6.14.3 |
| RBRE960 Orbi Quad-band Mesh WiFi 6E Router | V6.3.7.5 |
| RBS750 Orbi WiFi 6 Add-on Satellite AX4200 | V4.6.14.3 |
| RBS840 (EoS) Orbi WiFi 6 Add-on Satellite AX5700 | V4.6.14.3 |
| RBS850 Orbi WiFi 6 Satellite AX6000 | V4.6.14.3 |
| RBSE960 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | V6.3.7.5 |
| RS700 Nighthawk BE19000 WiFi 7 Tri-Band Router | V1.0.7.66 |
| XR1000 Nighthawk WiFi 6 Pro Gaming Router | v1.0.0.68 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
Severity: MEDIUM
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RBE970 Orbi Quad-band Mesh WiFi 7 Add-on Satellite | V9.12.4.9 |
| RBR750 Orbi WiFi 6 Router AX4200 | V7.2.8.5 |
| RBR840 (EoS) Orbi WiFi 6 System AX5700 | V7.2.8.5 |
| RBR850 Orbi WiFi 6 Router AX6000 | V7.2.8.5 |
| RBR860 Orbi Tri-band Mesh WiFi 6 Router – 860 Series | V7.2.8.5 |
| RBRE950 Orbi Quad-band Mesh WiFi 6E Router | V7.2.8.5 |
| RBRE960 Orbi Quad-band Mesh WiFi 6E Router | V7.2.8.5 |
| RBS750 Orbi WiFi 6 Add-on Satellite AX4200 | V7.2.8.5 |
| RBS840 (EoS) Orbi WiFi 6 Add-on Satellite AX5700 | V7.2.8.5 |
| RBS850 Orbi WiFi 6 Satellite AX6000 | V7.2.8.5 |
| RBS860 Orbi Tri-band Mesh WiFi 6 Add-on Satellite – 860 Series | V7.2.8.5 |
| RBSE950 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | V7.2.8.5 |
| RBSE960 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | V7.2.8.5 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
Severity: MEDIUM
Affected Products
Recommendation
NETGEAR strongly recommends that you install the latest firmware as soon as possible.
Issue fixed in:
| Product | Fixed Version |
|---|---|
| RBE970 Orbi Quad-band Mesh WiFi 7 Add-on Satellite | V9.12.4.9 |
A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
Severity: MEDIUM
Acknowledgments: tmotfl
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RBE370 Orbi Dual-band Mesh WiFi 7 Add-on Satellite | V12.1.2.1 |
| RBE770 Orbi Tri-band Mesh WiFi 7 Add-on Satellite | V10.5.20.10 |
| RBR750 Orbi WiFi 6 Router AX4200 | V7.2.8.5 |
| RBR840 (EoS) Orbi WiFi 6 System AX5700 | V7.2.8.5 |
| RBR850 Orbi WiFi 6 Router AX6000 | V7.2.8.5 |
| RBR860 Orbi Tri-band Mesh WiFi 6 Router – 860 Series | V7.2.8.5 |
| RBRE950 Orbi Quad-band Mesh WiFi 6E Router | V7.2.8.5 |
| RBRE960 Orbi Quad-band Mesh WiFi 6E Router | V7.2.8.5 |
| RBS750 Orbi WiFi 6 Add-on Satellite AX4200 | V7.2.8.5 |
| RBS840 (EoS) Orbi WiFi 6 Add-on Satellite AX5700 | V7.2.8.5 |
| RBS850 Orbi WiFi 6 Satellite AX6000 | V7.2.8.5 |
| RBS860 Orbi Tri-band Mesh WiFi 6 Add-on Satellite – 860 Series | V7.2.8.5 |
| RBSE950 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | V7.2.8.5 |
| RBSE960 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | V7.2.8.5 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows administrators connected to the local network to make unauthorized modification of router software and functionality. NETGEAR JR6150 reached End-of-Support status in 2018 and is no longer receiving security updates. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.
This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.
Severity: MEDIUM
Acknowledgments: Security Research Center (SRC) @ Concordia University
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| JR6150 (EoS) AC750 WiFi Router 802.11ac Dual Band Gigabit | EOS |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network to tamper with the router's integrity.
Severity: MEDIUM
Acknowledgments: pjqwudi
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| MR60 Nighthawk Mesh WiFi 6 Router | V1.1.7.132 |
| MR70 Nighthawk Mesh WiFi 6 Router | V1.0.3.28 |
| MR80 Nighthawk Tri-band Mesh WiFi 6 Router | V1.1.7.14 |
| MS60 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.1.7.132 |
| MS70 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.0.3.28 |
| MS80 Nighthawk Tri-band Mesh WiFi 6 Add-on Satellite | V1.1.7.14 |
| R6400v2 (EoS) AC1750 Smart WiFi Router 802.11ac Dual Band Gigabit | V1.0.4.128 |
| R6700v3 (EoS) Nighthawk AC1750 Smart WiFi Dual Band Gigabit Router | V1.0.4.128 |
| R6900P (EoS) Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router | V1.3.3.152 |
| R7000 (EoS) Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router | V1.0.11.216 |
| R7000P (EoS) Nighthawk AC2300 Smart WiFi Dual Band Gigabit Router | V1.3.3.152 |
| R7960P (EoS) Nighthawk X6S AC3600 Tri-Band WiFi Router | V1.4.4.92 |
| R8000P (EoS) Nighthawk X6S AC4000 Tri Band WiFi Router | V1.4.4.92 |
| R8500 (EoS) Nighthawk X8 AC5300 Smart WiFi Router | EOS |
| RAX20 (EoS) 4-Stream AX1800 WiFi 6 Router | V1.0.18.144 |
| RAX35v2 Nighthawk AX4 4-Stream AX3000 WiFi 6 Router | |
| RAX40v2 Nighthawk AX4 4-Stream WiFi Router | V1.0.12.118 |
| RAX41 (EoS) Nighthawk AX5 5-Stream AX3600 WiFi Router | V1.0.12.118 |
| RAX42 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.12.118 |
| RAX43 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.12.120 |
| RAX45 (EoS) Nighthawk AX6 6-Stream AX4300 WiFi Router | V1.0.12.118 |
| RAX48 Nighthawk AX6 6-Stream AX5200 WiFi 6 Router | V1.0.12.118 |
| RAX50 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.12.120 |
| RAX50S Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.12.120 |
| RAXE450 Nighthawk AXE10000 Tri-Band WiFi 6E Router | V1.0.10.86 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.0.10.86 |
| XR1000 Nighthawk WiFi 6 Pro Gaming Router | V1.0.0.68 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local network access to submit crafted input that bypasses intended management interface restrictions, resulting in unauthorized modification of protected router software or functionality.
Severity: MEDIUM
Acknowledgments: fxc233
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RAXE450 Nighthawk AXE10000 Tri-Band WiFi 6E Router | V1.2.14.114 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.2.14.114 |
An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to gain administrator access to the Orbi router. The listed NETGEAR models are affected by this vulnerability.
Severity: MEDIUM
Recommendation
NETGEAR strongly recommends that you install the latest firmware as soon as possible.
Issue fixed in:
| Product | Fixed Version |
|---|---|
| RBE970 Orbi Quad-band Mesh WiFi 7 Add-on Satellite | 6.3.8.11 |
| RBR350 Orbi AX1800 WiFi 6 Dual-band Mesh Router | V4.4.2.2 |
| RBR760 Orbi Tri-Band Mesh WiFi 6 Router | V6.3.8.11 |
| RBS350 Orbi AX1800 WiFi 6 Dual-band Mesh Add-on Satellite | V4.4.2.2 |
| RBS760 Orbi Tri-Band Mesh WiFi 6 Add-on Satellite | V6.3.8.11 |
Severity: LOW
Acknowledgments: SmallS
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| R7000 (EoS) Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router | V1.0.11.216 |
| RAX20 (EoS) 4-Stream AX1800 WiFi 6 Router | V1.0.18.144 |
| RAX35v2 Nighthawk AX4 4-Stream AX3000 WiFi 6 Router | V1.0.16.132 |
| RAX41 (EoS) Nighthawk AX5 5-Stream AX3600 WiFi Router | V1.0.16.132 |
| RAX41v2 Nighthawk AX5 5-Stream AX3600 WiFi Router | V1.1.4.28 |
| RAX42 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.16.132 |
| RAX42v2 Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.1.4.28 |
| RAX43 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.16.132 |
| RAX43v2 Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.1.4.28 |
| RAX45 (EoS) Nighthawk AX6 6-Stream AX4300 WiFi Router | V1.0.16.132 |
| RAX49S Nighthawk AX6 6-Stream AX5300 WiFi Router | V1.1.4.28 |
| RAX50 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.16.132 |
| RAX50S Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.16.132 |
| RAX50v2 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.1.4.28 |
| RAX54Sv2 Nighthawk AX6 6-Stream AX5400 WiFi Router | V1.1.4.28 |
| RAXE450 Nighthawk AXE10000 Tri-Band WiFi 6E Router | V1.2.14.114 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.2.14.114 |
| XR1000 Nighthawk WiFi 6 Pro Gaming Router | V1.1.0.22 |
| XR1000v2 Nighthawk WiFi 6 Pro Gaming Router | V1.1.0.22 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
Disclaimer This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information in the document or materials linked to the document is at your own risk. NETGEAR reserves the right to change or update this document at any time. NETGEAR expects to update this document as new information becomes available.
The above-listed vulnerabilities remain if you do not complete all recommended steps. NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification.