Netgear patches three flaws in its routers and extenders

Netgear has released firmware fixing three vulnerabilities in the CAX30, RAX30, RAX5, RAXE300 routers and EX3700, EX6120 extenders. They allow command execution, admin login bypass and session hijacking. Unsupported models such as the R7000 will get no fixes.

• CVE-2026-11732 in CAX30, RAX30, RAX5 and RAXE300 allows command execution when site blocking is on
• CVE-2026-11731 in RAX28, RAX29 and RAX30 bypasses admin login and alters settings
• CVE-2026-11730 in EX3700 and EX6120 lets attackers hijack an admin session
• R7000, RAX40 and R7300DST no longer receive security updates