CVE-2026-11730

Medium

Description

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

SeverityMedium

CVSS5.4

Exploit probability—

Product

EX3700

PublishedOct 13, 2026

First seenOct 13, 2026

Weakness typeCWE-335CWE-335

How to fix

Update

NETGEAR EX3700V1.0.0.102 or later
NETGEAR EX6120V1.0.1.74 or later

Patches

netgear.com/support/product/ex3700
netgear.com/support/product/ex6120
kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory

Affected products

Product	Affected versions	Fixed in
NETGEAR EX3700	v < V1.0.0.102	V1.0.0.102
NETGEAR EX6120	v < V1.0.1.74	V1.0.1.74

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.