CVE-2026-123180 · Infrastructure
NO FIX YET
Several NETGEAR RAX Wi-Fi router models lack an authentication check, so a client on the Wi-Fi network can read sensitive information and change device configuration, including administrator credentials. The attacker needs to be on the local network and already connected to the Wi-Fi, but needs no login to the router.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners of NETGEAR RAX routers where untrusted devices can join the Wi-Fi. The affected models and fixed firmware are not confirmed by NETGEAR in any source we could read, so unknown. Networks where only trusted devices connect to the Wi-Fi are at lower risk.
Not affected if no-untrusted-wifi-clients, unlisted-model
Who cares home-router, netgear, rax, wifi
Unknown from the sources.
A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This affects the confidentiality, integrity and availability of the router.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.