NETGEAR Security Advisory: CAX30, RAX30 and Nighthawk Firmware Updates, and the Models That Won't Be Fixed

Last updated: November 2026

This guide is for owners of the 13 NETGEAR models named in the company's October 2026 security advisory: the CAX30 cable modem router, the RAX28, RAX29, RAX30, RAX5, RAX40 and RAXE300 routers, the R7000, R7000P and R7300DST routers, the CBR40 Orbi cable modem router, and the EX3700 and EX6120 WiFi extenders. It lists the fixed firmware for each model, explains how serious each flaw is, and covers what to do with models that will not be fixed. Details were checked on November 11, 2026 against NETGEAR's advisory, the public CVE records and the US government's catalog of exploited vulnerabilities.

Key Takeaways

• NETGEAR disclosed six vulnerabilities across 13 models. By NETGEAR's own ratings, each one requires an attacker who is already on your WiFi or local network, and none had been reported as exploited as of November 10, 2026.
• Fixed firmware is listed for 11 models. NETGEAR says the CBR40 and the R7300DST will not be fixed.
• A second NETGEAR advisory, called PHP2Shell, covers the CAX30, RAX28, RAX29, RAX30, RAXE290 and RAXE300 and has no fixed firmware yet.

What did NETGEAR disclose in its October 2026 security advisory?

NETGEAR's October 2026 Security Advisory lists six vulnerabilities affecting 13 routers, extenders and cable modem routers. The matching CVE records were published on October 13, 2026, and the advisory page was last updated on October 28, 2026.

A CVE is a public ID number assigned to a specific security flaw. CVSS is the 0 to 10 scale used to score how severe a flaw is. NETGEAR labels all six flaws Medium under CVSS version 4.0. Readers should also know that NETGEAR's own CVE records give two of them, CVE-2026-11732 and CVE-2026-11731, a score of 8.8 (High) under the older CVSS version 3.1.

Which NETGEAR models are affected, and which firmware fixes them?

Eleven of the 13 models have fixed firmware listed, and two are marked "Won't Fix." The versions below are printed in NETGEAR's advisory.

Two notes on reading the table. The advisory lists the RAX30 twice, with V1.0.14.108 for one flaw and v1.0.15.110 for the other, so v1.0.15.110 or later is the version that covers both. For the RAX40 and the R7000, NETGEAR's June 2026 advisory lists higher version numbers than the October one, so install the latest firmware NETGEAR offers for your model and do not stop at the number in the table. Our R7000 guide tracks that router's final firmware and support status.

How serious are these NETGEAR vulnerabilities?

None of the six can be reached directly from the internet, according to NETGEAR's ratings. Each requires an attacker who is already connected to your WiFi or wired network, and three of them also require your router's admin password.

• CVE-2026-11732 (CAX30, RAX30, RAX5, RAXE300): a flaw in the Block Sites feature that could let someone on your network run commands on the router. NETGEAR says it applies only when Block Sites is turned on.
• CVE-2026-11731 (RAX28, RAX29, RAX30): an authentication bypass. Someone on your network could read device information or change admin settings without logging in.
• CVE-2026-11730 (EX3700, EX6120): predictable session IDs that could let someone on your network take over a logged-in admin session on the extender. NETGEAR's advisory labels it Medium, while its CVE record scores it 2.1 (Low).
• CVE-2026-9218 (CBR40, R7000, R7000P, RAX40): a flaw in the time server setting. The attacker must be on your network and already have the admin password.
• CVE-2026-107918 and CVE-2026-107917 (R7300DST): flaws in the LAN Setup and PPPoE Setup pages that require a logged-in administrator. NETGEAR says they were found using a simulated version of the router's software, and the advisory states the issue "has not been confirmed on physical production devices."

NETGEAR's advisory does not say whether any of the six has been used in attacks. As of the November 10, 2026 version of the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, none of them is listed.

How do I update NETGEAR router firmware?

You can update most NETGEAR routers from the Nighthawk app or from the router's web page at routerlogin.net. Both methods check NETGEAR's servers and install the newest firmware for your model.

In the Nighthawk app, per NETGEAR's instructions:

1. Connect your phone to the router's WiFi network.
2. Open the Nighthawk app and tap the image of your router.
3. Scroll down and tap CHECK FOR UPDATES, then UPDATE.

In a web browser:

1. Connect a computer to the router with an Ethernet cable and go to routerlogin.net. The user name is admin.
2. Select ADVANCED, then Administration. Some models show Settings, then Administration.
3. Select Firmware Update or Router Update, click Check, and click Yes if new firmware is found.
4. Leave the router powered on until it restarts.

To turn on automatic updates, go to ADVANCED, then Administration, then Router Update, find the Router Auto Firmware Update section, select Enable, and click Apply. NETGEAR's advisory says "we strongly advise you to enable automatic firmware updates on supported devices." On the EX3700 and EX6120 extenders, the update option is under Settings, then Firmware Update, or under Maintenance, then Firmware Upgrade.

Can I update the CAX30 myself, or does my ISP do it?

You can update part of it. NETGEAR says CAX-series cable modem routers use separate router firmware and cable firmware, and its support article states: "You can update the router firmware manually, but only your ISP can update the cable firmware."

The advisory does not say which of the two parts the fixed version, V2.3.4.12, belongs to. NETGEAR's update instructions point to the router side, which owners can install with the Nighthawk app or a browser. If the app shows a lower version and offers no update, contact NETGEAR support.

One more gap: the advisory names only the CAX30. It does not say whether the CAX30S, the same hardware sold with a NETGEAR Armor subscription, is affected.

What should I do if my NETGEAR model will not be fixed?

Plan to replace it. NETGEAR's advisory says of models marked EoS: "Models marked (EoS) have reached End-of-Support phase, and no security updates are planned." The company recommends retiring those devices.

End of support, which NETGEAR abbreviates EoS, means the manufacturer has stopped releasing firmware for a model. NETGEAR's policy page states: "Products that reach EOS no longer receive firmware updates, including important security updates."

The immediate risk on the two unfixed models is limited, because the remaining flaws require someone who is on your network and holds the admin password. The longer-term problem is that the next flaw found in a CBR40 or R7300DST will not be fixed either. Until you replace one, these steps reduce exposure:

• Change the router admin password to one you use nowhere else.
• Turn off remote management.
• Put visitors and smart home devices on the guest network so they are not on the same network as the router's admin page.

The RAX5, RAX40, R7000, R7000P and EX3700 are also marked end of support. They received a fix this time, so install it, but treat them as due for replacement. Our guide to how long routers last covers when to retire one, and our DOCSIS 3.1 modem guide covers replacements for a cable modem router such as the CBR40.

What is the PHP2Shell advisory, and does it affect the same routers?

PHP2Shell is a separate NETGEAR advisory, last updated October 28, 2026, covering two flaws in PHP software used inside some routers. It lists the CAX30, RAX28, RAX29, RAX30, RAXE290 and RAXE300, and it has no fixed firmware yet.

The advisory covers CVE-2026-109618 and CVE-2026-109619 and states: "This advisory will be updated when fixed firmware versions are available for the affected products." NETGEAR says the affected feature is reachable only by users already on the WiFi or wired network, and adds: "NETGEAR has not seen any evidence of exploits targeting these devices."

There is a gap between sources that readers should know about. NETGEAR rates both flaws Medium for its devices. The PHP project's own record rates CVE-2026-109618 at 9.2 (Critical), and CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on October 26, 2026. That listing is for PHP in general, not for NETGEAR routers specifically.

Until a fix arrives, NETGEAR's advice is the practical one: "do not allow untrusted users to connect to your WiFi network." Use the guest network for visitors and check the advisory page for updated firmware.

FAQ

Has my NETGEAR router been hacked through these flaws?

There is no public report of that. None of the six October CVEs appears in CISA's catalog of exploited vulnerabilities as of November 10, 2026, and each requires an attacker who is already on your network.

Can these NETGEAR vulnerabilities be exploited from the internet?

Not according to NETGEAR's ratings, which classify all six as requiring adjacent network access. In practice that means someone connected to your WiFi or plugged into your router.

What is the latest safe firmware for the NETGEAR RAX30?

NETGEAR's October 2026 advisory lists v1.0.15.110 as the version that fixes CVE-2026-11731 on the RAX30. Install that version or any newer one.

Does this advisory affect NETGEAR Orbi mesh systems?

Only one Orbi product is named: the CBR40, the Orbi cable modem router. It is marked end of support and will not be fixed.

What does EoS mean on a NETGEAR advisory?

EoS means End of Support. NETGEAR says no security updates are planned for models with that label.

Does a firmware update erase my settings?

A normal firmware update keeps your WiFi name, password and other settings. Do not unplug the router while the update is installing.

Sources and how this article was reported

Firmware versions, model lists and quotations come from NETGEAR's own advisories and support articles, read on November 11, 2026. Severity scores come from the public CVE records, which NETGEAR supplies for its own products. NETGEAR is the only source for most technical details, and no independent researcher has published an analysis we could find. ModemGuides sells refurbished networking equipment, including NETGEAR products.

• October 2026 NETGEAR Security Advisory
• NETGEAR Security Advisory for PHP2Shell Vulnerabilities
• NETGEAR: updating CAX-series and CBR-series firmware
• NETGEAR: updating router firmware in a web browser
• NETGEAR: enabling automatic firmware updates
• NETGEAR End of Service policy
• CISA Known Exploited Vulnerabilities catalog