Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by NETGEAR

CVE-2026-0417Insufficient input validation in certain NETGEAR routers

Medium 4.3

In plain English

A medium-severity improper input validation in MR60 from NETGEAR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 4.0)4.3Medium
Exploit odds (30 days)0.2%top 86.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network to tamper with the router's integrity.

Affected products (as reported)

VendorProductVersions
NETGEAR MR60 0 – before V1.1.7.132
NETGEAR MR70 0 – before V1.0.3.28
NETGEAR MR80 0 – before V1.1.7.14
NETGEAR MS60 0 – before V1.1.7.132
NETGEAR MS70 0 – before V1.0.3.28
NETGEAR MS80 0 – before V1.1.7.14
NETGEAR R6400v2 0 – before V1.0.4.128
NETGEAR R6700v3 0 – before V1.0.4.128
NETGEAR R6900P 0 – before V1.3.3.152
NETGEAR R7000 0 – before V1.0.11.216
NETGEAR R7000P 0 – before V1.3.3.152
NETGEAR R7960P 0 – before V1.4.4.92
NETGEAR R8000P 0 – before V1.4.4.92
NETGEAR R8500 0 – through 1.0.2.160
NETGEAR RAX20 0 – before V1.0.18.144
NETGEAR RAX35v2 0 – before V1.0.16.132
NETGEAR RAX40v2 0 – before V1.0.12.118
NETGEAR RAX41 0 – before V1.0.12.118
NETGEAR RAX42 0 – before V1.0.12.118
NETGEAR RAX43 0 – before V1.0.12.120
NETGEAR RAX45 0 – before V1.0.12.118
NETGEAR RAX48 0 – before V1.0.12.118
NETGEAR RAX50 0 – before V1.0.12.120
NETGEAR RAX50S 0 – before V1.0.12.120
NETGEAR RAXE450 0 – before V1.0.10.86
NETGEAR RAXE500 0 – before V1.0.10.86
NETGEAR XR1000 0 – before V1.0.0.68

Weakness: CWE-20 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber

References