Read the docs
TI-2026-71843 Aliases CVE-2026-107917GHSA-c4rg-x772-7mg3

Insufficient input validation in NETGEAR R7300 router PPPoE Setup

Priority LOW 19CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

NETGEAR R7300DST routers through V1.0.0.74 contain an input validation flaw (CWE-20) in the PPPoE Setup feature. An authenticated administrator connected to the local network can perform unauthorized actions on the router. The issue was found through testing in a controlled research environment using a simulated version of the router software and has not been confirmed on physical production devices.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00153 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARR7300DSTup to V1.0.0.74—No fix listedCNA
  • R7300DST VendorNETGEAR Affected up to V1.0.0.74 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for NETGEAR R7300DST.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    NETGEAR R7300DST — kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advi…

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-71844 Input validation flaw in NETGEAR R7300DST LAN SetupPriority LOW 19
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-107917
  2. 2026-10-13 Alias added: GHSA-c4rg-x772-7mg3
  3. 2026-10-13 CVSS score changed · CNA
  4. 2026-10-16 1 new reference · CNA

References

Patch 2

  • TI-2020-16346 NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-04600 Buffer overflow in NETGEAR All versions prior to WNR2000v3 1.1.2.14, WNR2000v4 1.0.0.66… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03982 ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-08250 The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-01416 (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-04162 dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1HIGH 8.8
See all 1364 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences