Thirteen NETGEAR routers, extenders and cable routers are named in the October 2026 NETGEAR advisory, posted on October 14, and 11 of them have a fixed firmware build. The Orbi CBR40 cable router and the Nighthawk R7300DST are marked “Won’t Fix.” NETGEAR rates all six flaws Medium, and every one needs an attacker who is already on your network or holds your admin password. For a Nighthawk RAX30 the fix has been on NETGEAR’s download page since September 10, so a router that installs updates on its own may already have it.
Six flaws and what each needs
Two of the six give someone on your network a way into a router without the admin password. On the CAX30, RAX30, RAX5 and RAXE300, someone with network access, such as a person who knows your Wi-Fi password, can run commands through the Block Sites feature (CVE-2026-11732). NETGEAR says this works only on routers where Block Sites is turned on. On the RAX28, RAX29 and RAX30, an attacker with adjacent access to the management service can skip the login, read device information and change administrative settings (CVE-2026-11731). Yanming Chen of Guangzhou University and Michael Gentile reported that one.
The EX3700 and EX6120 extenders hand out session identifiers that can be predicted, so someone on the network can take over an administrator’s open session on the web portal (CVE-2026-11730).
The other three need the admin password first. A crafted time server (NTP) setting runs commands on the CBR40, R7000, R7000P and RAX40 (CVE-2026-9218), and NETGEAR lists no effect on confidentiality or availability, only on integrity. Two input flaws in the R7300DST’s LAN Setup and PPPoE Setup pages let an administrator perform unauthorized actions (CVE-2026-107918 and CVE-2026-107917). The Security Research Center at Concordia University found them on a simulated copy of the router’s software, and NETGEAR says they have not been confirmed on physical routers.
Medium in the advisory, High in the CVE record
The two password-free router flaws carry two scores in their CVE records, both supplied by NETGEAR. Under CVSS 4.0 they score 6.3, Medium. Under CVSS 3.1 they score 8.8, High.
The difference comes from the threat setting in the 4.0 score. Its vector marks exploitation as unreported, which pulls the number down, and the 3.1 base score has no such input. Both vectors describe the same flaw: no login, no action by the owner, and high impact on the router’s confidentiality, integrity and availability.
CISA’s coordinators recorded no known exploitation for the authentication bypass and rated its technical impact “total.” On an unpatched RAX28, RAX29 or RAX30, anyone on the same network, a compromised laptop or camera included, could reach the admin settings without the password.
One build for the RAX30
The Nighthawk RAX30 appears in both password-free flaws. The advisory lists 1.0.14.108 as the fix for Block Sites and 1.0.15.110 as the fix for the login bypass. A RAX30 still on 1.0.14.108 is protected from the first and open to the second.
NETGEAR’s RAX30 download page lists 1.0.15.110 as the latest firmware, with release notes dated September 10, 2026. The notes say only that it addresses security vulnerabilities. That build is also newer than 1.0.9.92, the fix NETGEAR gave for the RAX30 in its September advisory for a flaw that let someone on the network crash the management interface.
The RAX28 and RAX29 share the 1.0.15.110 build. CAX30 owners need 2.3.4.12, RAXE300 owners 1.0.10.72 and EX6120 owners 1.0.1.74. Until a router on the Block Sites list is updated, turning that feature off removes the condition the command flaw depends on.
End of support, with fixes anyway
Every end-of-support model in the advisory carries NETGEAR’s standard line that no security updates are planned. Five of them got a fix in the same table: the RAX5 (1.0.5.34), the R7000 (1.0.11.130), the R7000P (1.3.3.152), the RAX40 (1.0.3.64) and the EX3700 extender (1.0.0.102). Owners of those models should install the build, because NETGEAR gives no sign that the next flaw will be fixed too.
The CBR40 and R7300DST get nothing. On both, every listed flaw starts with the admin password, so a long, unique one keeps an outsider who joins the network from using them. NETGEAR’s recommendation for end-of-support models is to retire them. The CBR40 is the cable modem and the router in one box, so retiring it means replacing both.