CVE-2026-0408
Path traversal vulnerability in Netgear WiFi Range Extenders
- Published
- Updated
- Reserved
- Assigned by
- NETGEAR
Description
A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically generated webproc file, which records the username and password submitted to the router GUI.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NETGEARCNA (assigner) | 4.0 | Medium6.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber |
| NVDNVD · Analyzed | 4.0 | Medium6.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber |
- EPSS (exploitation in 30 days)
- 0.25% · top 84% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Weakness
Affected products
What to do
Solution: Manually check the firmware version and update it to the latest. Fixed in: EX2800 firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex2800 EX3110 firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex3110 EX5000 firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex5000 EX6110 firmware V1.0.1.82 or later https://www.netgear.com/support/product/ex6110
References (5)
- https://www.netgear.com/support/product/ex5000 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/ex3110 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/ex6110 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/ex2800 (opens in a new tab)productpatch
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory (opens in a new tab)vendor-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-0408)Record last updated .