M4350 Firmware Version 14.0.9.13

Release Date:
November 12, 2026

Enhancements:

• Added the snmp-server fast-cache server enable CLI command and SNMP set support to enable faster updates of fiber-optic data to SNMP.
• Added the prioritize switch-destined arp CLI command to prioritize ARP packets destined for the switch.
• Added Insight support for managing switch stacks, including stack firmware upgrades.
• Enhanced the control plane attributes to ensure control packets are handled during heavy broadcast and multicast traffic in large AV network deployments.
• Added support for LED Dark Mode on M4350 switches.

The following table lists the SNMP OIDs that support the LED Dark Mode:

Bug Fixes:

• Fixes the issue where the DHCP server on the switch did not assign IP addresses to some clients, such as roaming wireless clients, while it was receiving other ICMP traffic. [CE-7587]
• Fixes the issue where the switch rebooted unexpectedly because of a crash in the ARP callback task while it was sending ICMP error messages. [CE-7633]
• Fixes the issue where AVB ports frequently changed between core and boundary, which let endpoints other than the preferred grandmaster become the master clock. [CE-7749]
• Fixes the issue where the output of the show ip pim statistics command was misaligned. [CE-7569]
• Fixes the issue where SFP optical readings reported through SNMP were out of sync with the CLI after an SFP port was shut down and enabled again. [CE-7687]
• Fixes the issue where the PVID Port Configuration page showed None in the Untagged column for trunk ports, even though VLAN 1 was the native untagged VLAN. [CE-7876]
• Fixes the issue where the switch supported only 16 link dependency groups. [CE-7976]
• Fixes the issue where IGMPv3 fast-leave did not work because the switch ignored IGMPv3 Block Old Sources reports, which caused video disruption when receivers changed multicast sources. [CE-7737]
• Fixes the issue where hosts intermittently received Destination host unreachable responses for one to two seconds when sending traffic through the switch. [CE-7940]
• Fixes the issue where the 802.1X guest VLAN was not assigned to 802.1X-unaware clients when the port host mode was multi-domain multi-host. [CE-7665]
• Fixes the issue where IGMP snooping failed to create new SSM source-specific group entries after about 60 streams, far below the supported scale. [CE-8089]
• Fixes the issue where multicast groups could expire intermittently when IGMP Plus was used with IGMP report suppression. [CE-8090]
• Fixes the issue where upgrading directly from firmware 14.0.6.19 to 14.0.9.10 failed because the digital signature of the image could not be verified. [CE-8223]
• Fixes the issue where the switch crashed and rebooted when an MLAG (vPC) configuration was removed while IGMP snooping was enabled. [MS-6045]
• Fixes the issue where all LAGs on the switch stopped working at random intervals, which caused a network outage. [CE-7636]
• Fixes the issue where the switch stopped responding on the network and its LACP LAG went down while the physical links stayed up. [CE-7597]
• Fixes the issue where an MLAG switch crashed and rebooted when its peer-link went down or its MLAG peer restarted. [CE-8383]
• Fixes the issue where PTP sync interval instability caused Milan AVB clocks to flap. [MS-6226]
• Fixes the issue where a custom PTP domain VLAN was reset to 0 after upgrading from firmware 14.0.6.19. [MS-6145]
• Fixes the issue where the switch crashed in the link status task when the clear config command removed a card. [MS-6259]
• Fixes the issue where the service port went down and did not link up again after the cable was swapped or reseated. [MS-6065]
• Fixes the issue where stack monitoring data was not sent to Insight, so the stack information in Insight stayed outdated. [MS-6277]
• Fixes the issue where Insight showed incorrect port authentication states and stale client and topology information for Insight-managed switches. [CE-7831]
• Fixes the issue where a stack could become corrupted after consecutive RX errors on its stack ports. [CE-7874]
• Fixes the issue where a 25G module in a 10G port did not link up at the correct speed. [CE-8109]
• Fixes the issue where a PoE 802.3bt port that was set to 802.3at with a 32 W user power limit did not deliver power correctly. [MS-4984]
• Fixes the issue where the RSTP max-age setting accepted a value that conflicted with the hello time. [MS-6156]
• Fixes the issue where the auto-trunk native VLAN was not renegotiated after the management VLAN changed, which caused switches to go offline in Engage. [CE-7918]
• Fixes the issue where the Last TCN label on the MST configuration page was unclear. [CE-7880]
• Fixes the issue where port LEDs on line cards sometimes stayed on in Dark Mode. [MS-6136]
• Fixes the issue where port LEDs stayed dark after a factory reset when Dark Mode had been enabled. [MS-6118]
• Fixes the issue where DHCP L2 relay inserted an incorrect Option-82 circuit-id or remote-id. [MS-6037]
• Fixes the issue where the web UI could not delete an OUI-based VLAN entry. [MS-6033]
• Fixes the issue where a password strength exclude keyword could not be created through SNMP set. [MS-6023]
• Fixes the issue where the show lldp remote-device command did not show the OUI and OUI subtype of organizationally specific TLVs. [MS-6012]
• Fixes the issue where the output of the show ipv6 pim statistics command was misaligned. [MS-6067]
• Fixes the issue where the switch crashed when a switch priority of 0 was set through the API. [MS-6060]
• Fixes the issue where switch renumbering did not complete when it was run from a configuration script. [PRJCBUGEN-64860]
• Fixes the issue where a 4x25G AOC breakout cable stayed link down when the port mode was configured before the cable was inserted.

AV UI Known Issues:

• gPTP Clock Master Causes Time Drift with AVB MILAN Devices:
  If the switch becomes the gPTP clock master, time drift issues may occur when AVB MILAN devices are in use.
  Workaround: When creating an "Audio Video AVB MILAN" profile in AVUI, set the Local Clock Priority 1 and Priority 2 values to 255 to prevent the switch from acting as the clock master.
• Stale Spanning Tree Configuration After Firmware Upgrade from AVUI 2.2.13.29:
  When upgrading firmware from AVUI 2.2.13.29 to the current release, access port configurations with no spanning-tree port mode may persist. If Dante devices are connected using redundancy ports, this can cause a network loop.
  Workaround: Manually clear the stale configuration by setting the affected interfaces back to spanning-tree port mode.
• Kramer AV Single-VLAN Profile Cannot Be Modified When Using VLAN 1:
  If a Kramer AV profile is created with a single VLAN and that VLAN is VLAN 1, the profile cannot be modified to another single-VLAN profile.
  Workaround: Use a VLAN ID other than VLAN 1 when creating a single-VLAN Kramer AV profile.

Known Firmware Issues:

• The boot code might not update automatically when upgrading to this firmware because the firmware size has increased.
  Workaround: Update the boot code manually, or upgrade to the same firmware version again.
• It is not possible to import a backup configuration into this firmware if it contains:
  • Legacy PTP commands used in firmware version 14.0.6.x
  • Configuration settings related to the removed 50G speed support
    Workaround: Back up the configuration before upgrading to firmware version 14.0.9.x. To restore the backup configuration, downgrade to firmware version 14.0.6.x first.
• Multiple PTP Domains limitations:
  • Support for only one global PTP source IP address. The PTP source IP address is selected according to the following priority:
    • Configured global PTP source IP address
    • Management VLAN IP address
  • Multiple PTP domains do not support a mix of one-step and two-step modes. All PTP domains must use either one-step mode or two-step mode. All PTP domains must use the same mode. Configuring different modes across the domains might result in unexpected behavior.
  • All ports within the same PTP domain must use the same VLAN. Configuring different VLANs for ports within the same PTP domain is not supported.
  • The PTP command format is updated to support multiple PTP domains. Existing PTP commands are migrated to the new command format during the upgrade. We do not recommend downgrading from firmware version 14.0.9.x to 14.0.6.x or earlier due to incompatible PTP command formats.
    Workaround: Back up configuration before upgrading to 14.0.9.x. Import the backup configuration with firmware 14.0.6.x.
• MLAG limitations:
  • Auto-MLAG is not supported.
    Workaround: Configure an MLAG manually through the CLI or device UI.
  • Communication between orphan ports is not supported. Clients cannot connect to only one MLAG switch.
    Workaround: Connect partner switches and clients redundantly to both MLAG switches.
  • The peer link creation might fail if MLAG is enabled and disabled repeatedly within a short period.
    Workaround: Ensure there is a 3 to 5 second delay between disabling MLAG and re-enabling MLAG. If the issue persists, disable it for 10 seconds, then enable it again.
  • The IGMP querier IP address must be identical on both MLAG switches. To provide redundancy and ensure that both switches can act as IGMP queriers, configure the same querier IP address on both switches.
  • MLAG does not support PTP boundary clock mode. Only transparent clock mode is supported.
• Anti-Configuration Error can be done in AVUI in Engage.
• Auto-LAG Global PTP mode in main UI configures PTP boundary clock on the newly formed Auto-LAG interface when it is enabled on the switch models that support PTP boundary clock mode.
  Workaround: Do not enable Auto-LAG Global PTP mode from main UI if you do not use the PTP boundary clock mode of operation and configure it manually on the newly formed Auto-LAG interface.
• G&D Control Center IP devices fail to link up with the switch.
  Workaround: Manually set the switch port speed to 1G to establish the link.
• This firmware includes a configuration migration process that transitions the default web browser protocol from HTTP to HTTPS. When you upgrade to this firmware and import an older configuration with HTTPS disabled, HTTPS becomes enabled.
  Workaround: Reconfigure the web browser protocol settings manually after you perform a firmware upgrade or import an older configuration.
• The first time you login, you must set up a password to access the switch. However, if you access the main UI before you set up a password and simultaneously set the password in the AV UI, the switch console might lock for up to 15 minutes.
  Workaround: Configure a password in either the main UI or the AV UI to avoid this lockup issue.
• If you upload only the private key or the certificate before you enable HTTPS, the system enables the HTTPS service but it fails to operate correctly because the configuration is incomplete. A factory reset does not fix this issue.
  Workaround: Ensure both the private key and certificate are fully uploaded before you enable HTTPS. If the issue still occurs, remove the incomplete HTTPS-related private key or certificate, and disable HTTPS before reconfiguring.
• The four 25G ports of models M4350-44M4X4V, M4350-24X4V, and M4350-24F4V can operate at either 10G or 25G speed but not simultaneously at 10G and 25G speed.
• A stacking link works only at the highest speed that the port supports. For example, if you configure a 25G port in stack mode, the port can operate only at 25G and not at 10G. Therefore, you cannot establish a stacking link if a 10G port and a 25G port are interconnected.
• With PIM and IGMPv2 snooping configured, multicast traffic might be sent to the CPU every 4 minutes. This can cause an intermittent black screen or loss of video and audio for inter-switch multicast traffic routed by PIM. Affected models: XSM4316, XSM4324, GSM4328, GSM4352, MSM4352, XSM4328CV, XSM4328FV, MSM4310, MSM4320, MSM4332, and MSM4328F.
  Workaround: Downgrade to firmware version 14.0.6.19 or contact NETGEAR Technical Support. The next firmware release fixes the issue.
• With PIM and IGMPv2 snooping configured and the IGMP Snooping Querier disabled on the VLAN where the multicast sources are connected, multicast data packets might be sent to the CPU after more than 240 seconds. The symptoms are the same as above.
  Workaround: Downgrade to firmware version 14.0.6.19 or contact NETGEAR Technical Support. The next firmware release fixes the issue.

Warnings:

Read and follow these warnings before updating your firmware:

• HTTPS is set to default web browser protocol from firmware version 14.0.6.10 and newer versions. The default certificate is self-signed, so a browser warning might display when you log in. To avoid this warning, you can download your own certificate that is issued by a trusted Certificate Authority (CA).

General Information:

• This switch firmware upgrades the boot code to version 1.0.0.18.
• The process of upgrading the firmware and boot code takes about three minutes. Apply the update bootcode command from the command line interface. Do not switch off or restart the device during the upgrade process.
• This switch firmware upgrades AppMgr to version 1.0.7.19.
• Insight and Engage/AV UI are mutually exclusive. This means you can only use one of these options to configure and manage the switch, not both.
• If the encrypted password in the configuration file does not adhere to the NETGEAR password policy, when the configuration file is loaded on the firmware version 14.0.6.9 or later, you must create a new password the first time you login.

Download Link: https://www.downloads.netgear.com/files/GDC/M4350/M4350_V14.0.9.13.zip

Firmware Update Instructions:

To update your product’s firmware, follow the instructions in your product’s user manual. To find your user manual, visit https://www.netgear.com/support/enterprise/, enter your model number in the search box, and click the Documentation button on the product page.