CVE-2026-0407

HIGH

NETGEAR WiFi Range Extenders - Auth Bypass

Title source: llm

Description

An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to bypass the authentication process and access the admin panel.

References (5)

[Various Sources] https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory

[Various Sources] https://www.netgear.com/support/product/ex2800

[Various Sources] https://www.netgear.com/support/product/ex3110

[Various Sources] https://www.netgear.com/support/product/ex5000

[Various Sources] https://www.netgear.com/support/product/ex6110

Scores

CVSS v3 8.0

EPSS 0.0008

EPSS Percentile 22.3%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-287

Status published

Affected Products (4)

netgear/ex5000_firmware < 1.0.1.82

netgear/ex3110_firmware < 1.0.1.82

netgear/ex6110_firmware < 1.0.1.82

netgear/ex2800_firmware < 1.0.1.82

Timeline

Published Jan 13, 2026

Tracked Since Feb 18, 2026