CVE-2026-0406: medium-severity vulnerability in NETGEAR XR1000v2
Insufficient input validation in NETGEAR Nighthawk router XR1000v2
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.3%
An insufficient input validation vulnerability in the NETGEAR XR1000v2
allows attackers connected to the router's LAN to execute OS command
injections.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:U/V:D/RE:M/U:Amber
Affected products
NETGEAR · XR1000v2Related CVEs — NETGEAR XR1000v2
In the same product, most dangerous first.
CVE-2026-11739MEDIUMCommand injection vulnerability in some NETGEAR Nighthawk devicesEPSS 2.5%CVE-2026-11736LOWStack-based buffer overflow vulnerability in some NETGEAR Nighthawk routersEPSS 0.8%CVE-2026-11735LOWStack-based buffer overflow vulnerability in some NETGEAR Nighthawk modelsEPSS 0.8%CVE-2025-25246HIGHCVE-2025-25246EPSS 0.7%CVE-2026-0410LOWInsufficient input validation in certain NETGEAR routersEPSS 0.2%CVE-2026-9215LOWA CSRF vulnerability exists in certain NETGEAR XR series devicesEPSS 0.2%