Read the docs
TI-2026-71754 Aliases CVE-2026-11730GHSA-4634-w7xm-gm3m

NETGEAR EX Series extenders predict session IDs, enabling hijacking

Priority LOW 10CWE-335Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

NETGEAR EX3700 extenders before V1.0.0.102 and NETGEAR EX6120 extenders before V1.0.1.74 are affected. A pseudo-random number generator is seeded incorrectly (CWE-335), so session identifiers can be predicted. A network-adjacent attacker with network access, such as WiFi credentials, can predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00185 8th percentileScored 2026-11-07
Fix Fixed EX3700 (NETGEAR): V1.0.0.102EX6120 (NETGEAR): V1.0.1.74

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEAREX3700before V1.0.0.102V1.0.0.102Patch availableCNA
NETGEAREX6120before V1.0.1.74V1.0.1.74Patch availableCNA
  • EX3700 VendorNETGEAR Affected before V1.0.0.102 Fixed in V1.0.0.102 Patch available CNA
  • EX6120 VendorNETGEAR Affected before V1.0.1.74 Fixed in V1.0.1.74 Patch available CNA

Remediation

Install V1.0.0.102 on the EX3700 and V1.0.1.74 on the EX6120, which are the fixed versions.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA EX3700 (NETGEAR) Fixed in V1.0.0.102
  • Fix · CNA EX6120 (NETGEAR) Fixed in V1.0.1.74

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-11730
  2. 2026-10-13 Alias added: GHSA-4634-w7xm-gm3m
  3. 2026-10-13 CVSS score changed · CNA
  4. 2026-10-16 1 new reference · CNA
  5. 2026-10-19 CISA SSVC decision points changed

References

Patch 3

  • TI-2020-16346 NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-04600 Buffer overflow in NETGEAR All versions prior to WNR2000v3 1.1.2.14, WNR2000v4 1.0.0.66… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03982 ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-08250 The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-01416 (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-04162 dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1HIGH 8.8
See all 1364 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences