Read the docs
TI-2026-00282 Aliases CVE-2026-0420GHSA-vww4-r7gr-9xvq

Missing TLS certificate validation in NETGEAR's ReadyCloud client app

Priority LOW 20CWE-325Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle (MiTM) style attacks impacting the product's confidentiality. This vulnerability affects the listed NETGEAR models.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00135 3rd percentileScored 2026-11-07
Fix Fixed RAX120v1 (NETGEAR): V1.2.9.52RAX120v2 (NETGEAR): V1.2.9.52+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARRAX120v1before V1.2.9.52V1.2.9.52Patch availableCNA
NETGEARRAX120v2before V1.2.9.52V1.2.9.52Patch availableCNA
NETGEARRAX35before V1.0.6.106V1.0.6.106Patch availableCNA
NETGEARRAX38before V1.0.6.106V1.0.6.106Patch availableCNA
NETGEARRAX40before V1.0.6.106V1.0.6.106Patch availableCNA
  • RAX120v1 VendorNETGEAR Affected before V1.2.9.52 Fixed in V1.2.9.52 Patch available CNA
  • RAX120v2 VendorNETGEAR Affected before V1.2.9.52 Fixed in V1.2.9.52 Patch available CNA
  • RAX35 VendorNETGEAR Affected before V1.0.6.106 Fixed in V1.0.6.106 Patch available CNA
  • RAX38 VendorNETGEAR Affected before V1.0.6.106 Fixed in V1.0.6.106 Patch available CNA
  • RAX40 VendorNETGEAR Affected before V1.0.6.106 Fixed in V1.0.6.106 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:netgear:rax120_firmware:*:*:*:*:*:*:*:*before 1.2.9.52VulnerableNETGEAR
cpe:2.3:h:netgear:rax120:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:h:netgear:rax120:1.0:*:*:*:*:*:*:*1.0Running onNETGEAR
cpe:2.3:h:netgear:rax120:2.0:*:*:*:*:*:*:*2.0Running onNETGEAR
cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:*before 1.0.6.106VulnerableNETGEAR
cpe:2.3:h:netgear:rax35:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax38_firmware:*:*:*:*:*:*:*:*before 1.0.6.106VulnerableNETGEAR
cpe:2.3:h:netgear:rax38:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax40_firmware:*:*:*:*:*:*:*:*before 1.0.6.106VulnerableNETGEAR
cpe:2.3:h:netgear:rax40:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:rax120_firmware:*:*:*:*:*:*:*:* Versions before 1.2.9.52 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:h:netgear:rax120:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·NETGEAR
  • cpe:2.3:h:netgear:rax120:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.106 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax38_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.106 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax38:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax40_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.106 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

  • Fix · CNA RAX120v1 (NETGEAR) Fixed in V1.2.9.52
  • Fix · CNA RAX120v2 (NETGEAR) Fixed in V1.2.9.52
  • Fix · CNA RAX35 (NETGEAR) Fixed in V1.0.6.106
  • Fix · CNA RAX38 (NETGEAR) Fixed in V1.0.6.106
  • Fix · CNA RAX40 (NETGEAR) Fixed in V1.0.6.106

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    NETGEAR RAX120v1, RAX120v2 — kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-08097 Insufficient authentication and input validation in certain NETGEAR productsPriority LOW 27
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0420
  2. 2026-10-03 Alias added: GHSA-vww4-r7gr-9xvq

References

Patch 4

Advisory 1

  • TI-2021-20706 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
  • TI-2021-20705 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
  • TI-2021-16116 Certain NETGEAR devices are affected by lack of access control at the function level. CVSS 3.1CRITICAL 10.0
  • TI-2021-09955 Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. CVSS 3.1CRITICAL 9.9
  • TI-2021-20745 Certain NETGEAR devices are affected by server-side injection. CVSS 3.1CRITICAL 9.8
  • TI-2020-18244 Certain NETGEAR devices are affected by incorrect configuration of security settings. CVSS 3.1CRITICAL 9.4
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences