Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

NETGEAR RAX5 Router Allows Unauthenticated Code Execution via WiFi Settings

CVE-2024-57235 · published 1 year ago
Summary

A security issue in the NETGEAR RAX5 WiFi Router allows an attacker to potentially execute unauthorized code on the device by manipulating the WiFi settings. This could allow an attacker to access sensitive data or take control of the router. Users should update their router's firmware to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
netgear rax50_firmware 1.0.2.26
cpe:2.3:o:netgear:rax50_firmware:1.0.2.26:*:*:*:*:*:*:*
Original advisory text
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published5 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-57235 · NVD
Track software like this
Free during beta