NETGEAR's Product Security Team has assessed the following product vulnerabilities and provided guidance to address these vulnerabilities in the table below.
Because firmware updates contain security fixes, bug fixes, and new features for your products, we strongly advise you to enable automatic firmware updates on supported devices. For older products, we advise you to download and install new firmware updates as soon as possible or follow the guidance provided for devices that require other remediation steps.
A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device.
This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
Severity: MEDIUM
Acknowledgments: Security Research Center (SRC) @ Concordia University
Affected Products
Recommendation
NETGEAR DGND3700v1 has reached End-of-Support phase, and no further security updates are planned. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.
A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable.
Severity: MEDIUM
Acknowledgments: fxc233
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RBE970 Orbi Quad-band Mesh WiFi 7 Add-on Satellite | V9.10.1.4 |
| RBE971 Orbi Quad-band Mesh WiFi 7 Router | V9.10.1.4 |
| RBR860 Orbi Tri-band Mesh WiFi 6 Router – 860 Series | V7.2.7.15 |
| RBRE950 Orbi Quad-band Mesh WiFi 6E Router | v7.2.7.15 |
| RBRE960 Orbi Quad-band Mesh WiFi 6E Router | V7.2.7.15 |
| RBS860 Orbi Tri-band Mesh WiFi 6 Add-on Satellite – 860 Series | V7.2.7.15 |
| RBSE950 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | v7.2.7.15 |
| RBSE960 Orbi Quad-band Mesh WiFi 6E Add-on Satellite | V7.2.7.15 |
A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation.
Severity: MEDIUM
Acknowledgments: fxc233
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RAXE450 Nighthawk AXE10000 Tri-Band WiFi 6E Router | V1.2.14.114 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.2.14.114 |
A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device.
Severity: MEDIUM
Acknowledgments: fluorescent
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| MR70 Nighthawk Mesh WiFi 6 Router | V1.0.4.48 |
| MS70 Nighthawk Mesh WiFi 6 Add-on Satellite | V1.0.4.48 |
| RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router | V1.2.14.114 |
| XR1000 Nighthawk WiFi 6 Pro Gaming Router | V1.0.2.86 |
A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router.
Severity: MEDIUM
Acknowledgments: Matt19
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| RAX43 (EoS) Nighthawk AX5 5-Stream AX4200 WiFi Router | V1.0.17.142 |
| RAX45 (EoS) Nighthawk AX6 6-Stream AX4300 WiFi Router | V1.0.17.142 |
| RAX50 Nighthawk AX6 6-Stream AX5400 WiFi 6 Router | V1.0.17.142 |
| RAX54S Nighthawk AX6 6-Stream AX5400 WiFi Router | V1.0.17.142 |
| RAX54Sv2 Nighthawk AX6 6-Stream AX5400 WiFi Router | V1.1.6.36 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings
Severity: MEDIUM
Acknowledgments: ziqiweiaaa
Affected Products
Recommendation
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| WAX333 Insight Managed WiFi 6 AX3000 Dual-band Access Point with Gigabit PoE (3-pack) | V12.8.0.100 |
Disclaimer This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information in the document or materials linked to the document is at your own risk. NETGEAR reserves the right to change or update this document at any time. NETGEAR expects to update this document as new information becomes available.
The above-listed vulnerabilities remain if you do not complete all recommended steps. NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification.