Your Netgear router may be vulnerable to a security exploit - how to check and patch it

Netgear has released firmware updates for a set of routers and range extenders affected by security vulnerabilities that could let attackers run unauthorized commands or tamper with device settings. The flaws are rated medium severity, and Netgear has published a security advisory describing how each affected model is exposed. The company has issued new firmware for the impacted devices, which owners can install through the router's settings or download from Netgear's website.

The first flaw, tracked as CVE-2026-11732, could be exploited by an attacker who already has access to the network, most likely through Wi-Fi credentials, to run unauthorized commands on the device. It is exploitable only when the Block Sites feature, which blocks access to specific sites based on domain name or keywords, has been enabled. The RAX5 4-Stream AX1600 WiFi 6 Router is among the affected models and has reached end of service, so the latest update will be its last. Netgear advises owners of that router to move to a newer device.

A second vulnerability, CVE-2026-11731, could allow an unauthenticated attacker with access to the local network and the router's management service to view and modify certain device details and administrative settings. A third, CVE-2026-11730, affects two Netgear range extenders and could let an attacker with local network access hijack an authenticated administrator session on the device's web management portal. The EX3700 AC750 WiFi Range Extender Essentials Edition is one of those two and has reached end of service, meaning owners should replace it with a newer device.

The remaining routers affected by the flaws have all reached end of service, so no further updates will be available and Netgear advises owners to switch to newer devices. One of those flaws, CVE-2026-9218, could be exploited by an attacker connected to the router's local network who has the administrator username and password to run unauthorized commands on the device.

For the CBR40 Orbi AC2200 Tri-band WiFi Cable Modem Router, the latest firmware will not fix the current security bug, and Netgear recommends that owners move to a newer device to stay secure. The other remaining affected Netgear router is also at end of service, and its latest firmware will not address its security flaws. Netgear again advises owners to replace it with a newer, more secure device.

More cybersecurity news from TechManNews.