CVE-2026-11732

HighCVSS 8.8

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability applies only when the Block Sites feature is turned on.

Risk Assessment

An attacker with network access can take control of the router, threatening the confidentiality, integrity, and availability of the device and the entire organization's network.

Recommendation

Disable the Block Sites feature if not in use, update the router firmware to a patched version, and restrict WiFi network access to trusted devices only.

Other vulnerabilities in NETGEAR Router

CVE-2026-9218Medium
Listed NETGEAR router models have insufficient input validation in the time server (NTP) setting. An attacker connected to the router's local network with administrator credentials can run unauthorized commands on the router. This impacts router integrity, with no impact on confidentiality or availability.

Original NVD description (English source)

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS