An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
ProductFixed VersionCAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router
V2.3.4.12 https://www.netgear.com/support/product/cax30/
RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router
V1.0.14.108 https://www.netgear.com/support/product/rax30/
RAX5 (EoS) 4-Stream AX1600 WiFi 6 Router V1.0.5.34 https://www.netgear.com/support/product/rax5/ RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router V1.0.10.72 https://www.netgear.com/support/product/raxe300/
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.