CVE-2026-62656 - Vulnerability Details - OpenCVE

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.netgear.com/support/product/raxe450/
https://www.netgear.com/support/product/raxe500/

History

Tue, 14 Jul 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation.
Title		Post-authenticated command injection vulnerability found in certain NETGEAR RAX models
Weaknesses		CWE-20
References		https://www.netgear.com/support/product/raxe450/ https://www.netgear.com/support/product/raxe500/
Metrics		cvssV4_0 `{'score': 5.4, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P'}`

MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published: 2026-07-14T17:46:15.194Z

Updated: 2026-07-14T17:46:15.194Z

Reserved: 2026-07-14T16:31:02.508Z

Link: CVE-2026-62656

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62656", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "state": "PUBLISHED", "assignerShortName": "NETGEAR", "dateReserved": "2026-07-14T16:31:02.508Z", "datePublished": "2026-07-14T17:46:15.194Z", "dateUpdated": "2026-07-14T17:46:15.194Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-07-14T17:46:15.194Z"}, "title": "Post-authenticated command injection vulnerability found in certain NETGEAR RAX models", "datePublic": "2026-07-14T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "affected": [{"vendor": "NETGEAR", "product": "RAXE450", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.2.14.114", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "RAXE500", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.2.14.114", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A\nsecurity flaw was found in certain NETGEAR RAX models that could allow\na logged-in user to send specially crafted requests to the router and run\nunauthorized commands. This could enable the user to make unauthorized changes\nto the router and affect its security and operation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>A\nsecurity flaw was found in certain NETGEAR RAX models that could allow\na logged-in user to send specially crafted requests to the router and run\nunauthorized commands. This could enable the user to make unauthorized changes\nto the router and affect its security and operation.</span></p>"}]}], "references": [{"url": "https://www.netgear.com/support/product/raxe450/", "tags": ["product", "patch"]}, {"url": "https://www.netgear.com/support/product/raxe500/", "tags": ["product", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"}}], "solutions": [{"lang": "en", "value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionRAXE450 Nighthawk AXE10000 Tri-Band WiFi 6E Router V1.2.14.114 https://www.netgear.com/support/product/raxe450/ RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router V1.2.14.114 https://www.netgear.com/support/product/raxe500/", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table style=\"border-collapse:collapse;\"><thead><tr><th style=\"border:1px solid gray;padding:4px 8px;text-align:left;\">Product</th><th style=\"border:1px solid gray;padding:4px 8px;text-align:left;\">Fixed Version</th></tr></thead><tbody><tr><td style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"><b>RAXE450</b> Nighthawk AXE10000 Tri-Band WiFi 6E Router</td><td style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"><a href=\"https://www.netgear.com/support/product/raxe450/\">V1.2.14.114</a></td></tr><tr><td style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"><b>RAXE500</b> Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router</td><td style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"><a href=\"https://www.netgear.com/support/product/raxe500/\">V1.2.14.114</a></td></tr></tbody></table>"}]}], "credits": [{"lang": "en", "value": "fxc233", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}}}