Insufficient Session Randomness in NETGEAR Extenders
CVE-2026-11730

4.5MEDIUM

Key Information:

Vendor

Netgear
Status
Ex3700
Ex6120
Vendor
CVE Published:
13 October 2026

What is CVE-2026-11730?

A vulnerability exists in certain NETGEAR Extender models where insufficient randomness in session identifiers allows an attacker with network access, such as from WiFi, to predict and hijack valid sessions. This flaw could lead to unauthorized access to the web management portal, compromising the device’s integrity and the administrative controls associated with it.

Affected Version(s)

EX3700 0

EX6120 0

References

https://www.netgear.com/support/product/ex3700
productpatch
https://www.netgear.com/support/product/ex6120
productpatch

CVSS V4

Score:
4.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

KDec5ae262-35b5-41c5-9bc1-91ad34145487 and Austin Turecek (Collaborator)
.