Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models
Priority LOW 23CWE-599Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0015 4th percentileScored 2026-11-07
Fix Fixed MR70 (NETGEAR): V1.0.4.48MS70 (NETGEAR): V1.0.4.48+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NETGEAR | MR70 | before V1.0.4.48 | V1.0.4.48 | Patch available | CNA |
| NETGEAR | MS70 | before V1.0.4.48 | V1.0.4.48 | Patch available | CNA |
| NETGEAR | RAXE500 | before V1.2.14.114 | V1.2.14.114 | Patch available | CNA |
| NETGEAR | XR1000 | before V1.0.2.86 | V1.0.2.86 | Patch available | CNA |
- MR70 VendorNETGEAR Affected before V1.0.4.48 Fixed in V1.0.4.48 Patch available CNA
- MS70 VendorNETGEAR Affected before V1.0.4.48 Fixed in V1.0.4.48 Patch available CNA
- RAXE500 VendorNETGEAR Affected before V1.2.14.114 Fixed in V1.2.14.114 Patch available CNA
- XR1000 VendorNETGEAR Affected before V1.0.2.86 Fixed in V1.0.2.86 Patch available CNA
Remediation
- Fix · CNA MR70 (NETGEAR) Fixed in V1.0.4.48
- Fix · CNA MS70 (NETGEAR) Fixed in V1.0.4.48
- Fix · CNA RAXE500 (NETGEAR) Fixed in V1.2.14.114
- Fix · CNA XR1000 (NETGEAR) Fixed in V1.0.2.86
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
NETGEAR RAXE500 — kb.netgear.com/000070859/July-2026-NETGEAR-Security-Advisory
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-44769 Post-authenticated command injection vulnerability found in certain NETGEAR RAX modelsPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-62657
- 2026-10-03 Alias added: GHSA-h6xv-84v7-xhr4
References
More NETGEAR vulnerabilities
- TI-2020-16346 NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. KEVCVSS 3.1CRITICAL 9.8
- TI-2017-04600 Buffer overflow in NETGEAR All versions prior to WNR2000v3 1.1.2.14, WNR2000v4 1.0.0.66… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-03982 ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-08250 The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-01416 (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-04162 dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2026-62657 · CVE Program
- CVE-2026-62657 · NVD
- FIRST EPSS
- GHSA-h6xv-84v7-xhr4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences