CVE-2026-11730

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Score

CVSS 3.1 5.4 Medium

Status

Awaiting Analysis - a2826606-91e7-4eb6-899e-8484bd4575d5

Published

2026-10-13

Last modified

2026-10-19

Weaknesses

CWE-335

Affected products

• Ex3700 (Netgear)
• Ex6120 (Netgear)

References

• https://www.netgear.com/support/product/ex3700
• https://www.netgear.com/support/product/ex6120
• https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory