NETGEAR: security record
CISA's Known Exploited Vulnerabilities catalog lists 8 flaws in NETGEAR routers and network gear that attackers have exploited in the wild, added between 3 November 2021 and 8 September 2022.
What this list means
CISA adds a flaw to its Known Exploited Vulnerabilities catalog when there is reliable evidence that attackers have used it in the wild and clear steps exist to fix or reduce it. A listed flaw usually has a patch or workaround from the maker. Some older devices are no longer supported and will not be fixed. If you own an affected model, check the maker's notice, update the firmware or replace the device if it is out of support.
NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
NETGEAR Multiple Devices Buffer Overflow Vulnerability
Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
NETGEAR DGN2200 Devices OS Command Injection Vulnerability
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
NETGEAR Multiple WAP Devices Command Injection Vulnerability
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.
NETGEAR DGN2200 Remote Code Execution Vulnerability
NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
NETGEAR Multiple Routers Remote Code Execution Vulnerability
NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.
Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
Netgear JGS516PE devices contain a missing function level access control vulnerability.
A listing shows that a flaw was exploited, not how a maker compares overall. Makers with many devices in use tend to appear more often. Check the maker's own notice for the models and firmware versions affected.
Sources
- Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, version 2026.10.28, released 28 October 2026
- National Institute of Standards and Technology, National Vulnerability Database
Checked 29 October 2026.