CVE-2026-0418

CVE-2026-0418 is a medium-severity vulnerability in Netgear Cbr750 Firmware with a CVSS 3.x base score of 4.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-610.

Key facts

• Severity: Medium (CVSS 3.x base score 4.5)
• CVSS v4: 4.3
• EPSS exploit prediction: 0% (16th percentile)
• Actively exploited: Not listed in CISA KEV
• EU (EUVD) id: EUVD-2026-35461
• Weakness: CWE-610
• Affected product: Netgear Cbr750 Firmware
• Published: 2026-06-09
• Last modified: 2026-06-18

Description

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

Frequently asked questions

What is CVE-2026-0418?

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

How severe is CVE-2026-0418?

CVE-2026-0418 has a CVSS 3.x base score of 4.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-0418 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-0418?

CVE-2026-0418 primarily affects Netgear Cbr750 Firmware. In total, 35 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-0418?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-0418 have an EU (EUVD) identifier?

Yes. CVE-2026-0418 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35461.

When was CVE-2026-0418 published?

CVE-2026-0418 was published on 2026-06-09 and last updated on 2026-06-18.

References

• https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
• https://www.netgear.com/support/product/cbr750/
• https://www.netgear.com/support/product/ex6120/
• https://www.netgear.com/support/product/ex6130/
• https://www.netgear.com/support/product/mr60/
• https://www.netgear.com/support/product/mr70/
• https://www.netgear.com/support/product/mr80/
• https://www.netgear.com/support/product/ms60/
• https://www.netgear.com/support/product/ms70/
• https://www.netgear.com/support/product/ms80/
• https://www.netgear.com/support/product/rax15/
• https://www.netgear.com/support/product/rax20/
• https://www.netgear.com/support/product/rax200/
• https://www.netgear.com/support/product/rax35v2/
• https://www.netgear.com/support/product/rax38v2/
• https://www.netgear.com/support/product/rax40v2/
• https://www.netgear.com/support/product/rax42/
• https://www.netgear.com/support/product/rax43/
• https://www.netgear.com/support/product/rax45/
• https://www.netgear.com/support/product/rax48/
• https://www.netgear.com/support/product/rax50/
• https://www.netgear.com/support/product/rax50s/
• https://www.netgear.com/support/product/rax75/
• https://www.netgear.com/support/product/rax80/
• https://www.netgear.com/support/product/raxe450/
• https://www.netgear.com/support/product/raxe500/
• https://www.netgear.com/support/product/rbr750/
• https://www.netgear.com/support/product/rbr840/
• https://www.netgear.com/support/product/rbr850/
• https://www.netgear.com/support/product/rbre960/

Affected products (35)

• cpe:2.3:o:netgear:cbr750_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:ex6120_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:ex6130_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:mr60_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:mr70_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:mr80_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:ms60_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:ms70_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:ms80_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax15_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax20_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax200_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax35v2_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax38v2_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax40v2_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax42_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax43_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax45_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax48_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax50_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax50s_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax75_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rax80_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:raxe450_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:raxe500_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbr750_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbr840_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbr850_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbre960_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbs750_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbs840_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbs850_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rbse960_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:rs700_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Netgear Cbr750 Firmware

• CVE-2021-45630 — Critical (CVSS 10.0): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before…
• CVE-2021-45635 — Critical (CVSS 9.6): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before…
• CVE-2021-45634 — Critical (CVSS 9.6): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before…
• CVE-2021-45633 — Critical (CVSS 9.6): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before…
• CVE-2021-45632 — Critical (CVSS 9.6): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before…
• CVE-2021-45631 — Critical (CVSS 9.6): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before…

All CVEs affecting Netgear Cbr750 Firmware →

Other CWE-610 vulnerabilities

• CVE-2022-27593 — Critical (CVSS 10.0): An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo…
• CVE-2019-7290 — Critical (CVSS 10.0): An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A…
• CVE-2017-16088 — Critical (CVSS 10.0): The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized…
• CVE-2022-39206 — Critical (CVSS 9.9): Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the…
• CVE-2026-47643 — Critical (CVSS 9.8): External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a…
• CVE-2022-20239 — Critical (CVSS 9.8): remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the…

Browse all CWE-610 vulnerabilities →