{"id":"CVE-2026-123180","kind":"vulnerability","aliases":["CVE-2026-123180"],"related":[],"title":"NETGEAR RAX routers: missing authentication exposes admin credentials to Wi-Fi users","description":"A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This affects the confidentiality, integrity and availability of the router.","summary":"Several NETGEAR RAX Wi-Fi router models lack an authentication check, so a client on the Wi-Fi network can read sensitive information and change device configuration, including administrator credentials. The attacker needs to be on the local network and already connected to the Wi-Fi, but needs no login to the router.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-router","infrastructure","netgear","rax","wifi"],"not_affected_if":["no-untrusted-wifi-clients","unlisted-model"],"how_to_check":"- Find your NETGEAR RAX model and firmware version in the router admin page or on the device sticker\n- NETGEAR has not published an advisory for this CVE that we could find; check https://www.netgear.com/security/advisories/ and your model's support page for a firmware newer than yours\n- An unconfirmed aggregator (hol.org) lists RAX30 as affected below v1.0.15.110; treat that as a lead, not a fact","fix":null,"status":"open","published_at":"2026-11-10T17:17:23+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","triaged_at":"2026-11-10T17:23:45+00:00","updated_at":"2026-11-10T17:26:09+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T17:23:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NETGEAR RAX routers: missing authentication exposes admin credentials to Wi-Fi users","impact":"high","summary":"Several NETGEAR RAX Wi-Fi router models lack an authentication check, so a client on the Wi-Fi network can read sensitive information and change device configuration, including administrator credentials. The attacker needs to be on the local network and already connected to the Wi-Fi, but needs no login to the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["netgear","rax","home-router","wifi"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads secrets and takes over the router's administrator settings.","analyst_note":"Find the NETGEAR advisory for CVE-2026-123180 to list affected RAX models and the fixed firmware versions.","how_to_check":"- Identify the NETGEAR RAX model and firmware version in the router admin page or the sticker on the device\n- Compare the firmware against the affected model list in the NETGEAR security advisory (unknown in the sources given)","plain_action":"Check the NETGEAR support site for a firmware update for your RAX router and install it when it appears.","product_name":"","needs_analyst":true,"not_affected_if":["unlisted-model","no-untrusted-wifi-clients"],"who_is_affected":"Owners of listed NETGEAR RAX router models where Wi-Fi clients can reach the router's management interface. Networks where no untrusted devices connect to the Wi-Fi are at lower risk, but the sources do not list the exact affected models or firmware versions, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":4557,"output_tokens":614,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the NETGEAR advisory for CVE-2026-123180 to list affected RAX models and the fixed firmware versions.","search":"'-123180':16A,19A '-2026':15A,18A 'adjac':96C 'admin':7A 'administr':57B,114C 'affect':122C 'allow':93C 'alreadi':69B 'attack':60B,97C 'authent':5A,37B,85C,100C,117C 'avail':127C 'chang':53B 'check':38B 'client':41B 'confidenti':124C 'configur':55B,112C 'connect':70B 'credenti':8A,58B,115C 'cve':14A,17A 'devic':54B,111C,120C 'expos':6A 'fi':12A,32B,46B,75B 'home':21B 'home-rout':20B 'includ':56B,113C 'inform':51B,107C 'infrastructur':23B 'integr':125C 'lack':35B 'list':89C 'local':66B 'login':79B 'miss':4A,84C 'model':34B,92C 'need':61B,77B 'netgear':1A,24B,28B,90C 'network':47B,67B,95C,103C 'obtain':105C 'rax':2A,25B,29B,91C 'read':49B 'router':3A,22B,33B,82B,130C 'sensit':50B,106C 'sever':27B 'tamper':109C 'user':13A 'vulner':86C 'wi':11A,31B,45B,74B 'wi-fi':10A,30B,44B,73B 'wifi':26B,102C 'without':116C","nicknames":[],"mitigations":[],"who_affected":"Owners of NETGEAR RAX routers where untrusted devices can join the Wi-Fi. The affected models and fixed firmware are not confirmed by NETGEAR in any source we could read, so unknown. Networks where only trusted devices connect to the Wi-Fi are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Check for a firmware update for your NETGEAR router in the NETGEAR app or at netgear.com/support, and install it when one is offered.","pkeys":[],"ptokens":[],"labels":["high","homerouter","infrastructure","netgear","rax","wifi"],"campaign_type":null,"search_a":"'-123180':16A,19A '-2026':15A,18A 'admin':7A 'authent':5A 'credenti':8A 'cve':14A,17A 'expos':6A 'fi':12A 'miss':4A 'netgear':1A 'rax':2A 'router':3A 'user':13A 'wi':11A 'wi-fi':10A","search_b":"'administr':57B 'alreadi':69B 'attack':60B 'authent':37B 'chang':53B 'check':38B 'client':41B 'configur':55B 'connect':70B 'credenti':58B 'devic':54B 'fi':32B,46B,75B 'home':21B 'home-rout':20B 'includ':56B 'inform':51B 'infrastructur':23B 'lack':35B 'local':66B 'login':79B 'model':34B 'need':61B,77B 'netgear':24B,28B 'network':47B,67B 'rax':25B,29B 'read':49B 'router':22B,33B,82B 'sensit':50B 'sever':27B 'wi':31B,45B,74B 'wi-fi':30B,44B,73B 'wifi':26B","search_c":"'adjac':96C 'administr':114C 'affect':122C 'allow':93C 'attack':97C 'authent':85C,100C,117C 'avail':127C 'confidenti':124C 'configur':112C 'credenti':115C 'devic':111C,120C 'includ':113C 'inform':107C 'integr':125C 'list':89C 'miss':84C 'model':92C 'netgear':90C 'network':95C,103C 'obtain':105C 'rax':91C 'router':130C 'sensit':106C 'tamper':109C 'vulner':86C 'wifi':102C 'without':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber","cvss_by":"a2826606-91e7-4eb6-899e-8484bd4575d5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123180","severity":null,"published_at":"2026-11-10T17:17:23+00:00","modified_at":"2026-11-10T17:17:23+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","fetched_at":"2026-11-10T17:22:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123180:2480","url":null,"severity":null,"published_at":"2026-11-10T17:26:09+00:00","modified_at":"2026-11-10T17:26:09+00:00","first_seen_at":"2026-11-10T17:26:09+00:00","fetched_at":"2026-11-10T17:26:09+00:00","note":"No NETGEAR advisory for this CVE found (Oct/Sep 2026 KB advisories cover other CVEs; NVD page unreadable via fetch). Only a secondary aggregator (hol.org) claims RAX30 affected, fixed in v1.0.15.110, and rates CVSS 6.3 vs our 8.8; unconfirmed, not recorded as fix or product. Nothing verified. Revisit when NETGEAR publishes its November 2026 advisory (kb.netgear.com). web-cli search worked this run; x-cli not tried."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}