Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-11730: Netgear EX3700 and EX6120 admin web login can be hijacked
CVE-2026-11730 · published 5 days ago
Summary
The web management interfaces on the Netgear EX3700 and EX6120 Wi‑Fi extenders use predictable session identifiers. An attacker who is on the same network and learns the Wi‑Fi password could guess a valid session ID and take over an administrator’s logged‑in session. Apply the latest firmware update from Netgear as soon as possible to fix the issue.
What to do
- Update netgear ex3700 to version V1.0.0.102 or later.
- Update netgear ex6120 to version V1.0.1.74 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| netgear | ex3700 | < V1.0.0.102 |
| netgear | ex6120 | < V1.0.1.74 |
Original advisory text
Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Severity
2.1
Low
Type
CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Timeline
Published13 Oct 2026
Updated17 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta