{"id":"CVE-2026-11731","state":"PUBLISHED","title":"Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models","description":"An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.","publishedAt":"2026-10-13T14:41:42.298Z","updatedAt":"2026-10-16T13:58:30.825Z","severity":{"score":6.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/V:D/U:Amber","source":"NETGEAR"},"assigner":"NETGEAR","products":["NETGEAR RAX30","NETGEAR RAX29","NETGEAR RAX28"],"affected":[{"vendor":"NETGEAR","product":"RAX30","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.0.15.110","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RAX29","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.0.15.110","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RAX28","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.0.15.110","versionType":"custom"}]}],"references":["https://www.netgear.com/support/product/rax30","https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory"],"weaknesses":["CWE-288"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/11xxx/CVE-2026-11731.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-11731","state":"PUBLISHED","datePublished":"2026-10-13T14:41:42.298Z","dateUpdated":"2026-10-16T13:58:30.825Z","assignerShortName":"NETGEAR","assignerOrgId":"a2826606-91e7-4eb6-899e-8484bd4575d5","dateReserved":"2026-06-09T02:46:39.902Z"},"containers":{"cna":{"title":"Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models","descriptions":[{"lang":"en","value":"An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions."}],"affected":[{"vendor":"NETGEAR","product":"RAX30","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.0.15.110","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RAX29","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.0.15.110","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RAX28","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.0.15.110","versionType":"custom"}]}],"references":[{"url":"https://www.netgear.com/support/product/rax30","tags":["product","patch"]},{"url":"https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.3,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/V:D/U:Amber"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-288","lang":"en","description":"CWE-288 Authentication bypass using an alternate path or channel","type":"CWE"}]}],"providerMetadata":{"shortName":"NETGEAR","orgId":"a2826606-91e7-4eb6-899e-8484bd4575d5","dateUpdated":"2026-10-16T13:58:30.825Z"},"datePublic":"2026-10-13T00:00:00.000Z","impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"solutions":[{"lang":"en","value":"Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionRAX28 Nighthawk AX5 5-Stream AX2200 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax28 RAX29 Nighthawk AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax29 RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax30","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>RAX28</b> Nighthawk AX5 5-Stream AX2200 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax28\">v1.0.15.110</a></td></tr><tr><td><b>RAX29</b> Nighthawk AX2400 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax29\">v1.0.15.110</a></td></tr><tr><td><b>RAX30</b> Nighthawk AX5 5-Stream AX2400 WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/rax30\">v1.0.15.110</a></td></tr></tbody></table>"}]}],"credits":[{"lang":"en","value":"Yanming Chen of Guangzhou University","type":"finder"},{"lang":"en","value":"Michael Gentile","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-13T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-11731"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T03:59:11.952Z"}}]}}}