Description
Improper certificate
validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream
AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band
WiFi 6E Router) allows attackers with the ability to intercept and
tamper traffic destined to the device to execute arbitrary commands on the
device.
Devices
with automatic updates enabled may already have this patch applied. If not,
please check the firmware version and update to the
latest.
Fixed in:
RAX30 firmware
1.0.14.108 or later.
RAXE300 firmware
1.0.9.82 or later
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NETGEAR | RAX30 | < 1.0.10.95 | 1.0.10.95 |
| NETGEAR | RAXE300 | < 1.0.9.82 | 1.0.9.82 |
References
- https://www.netgear.com/support/product/rax30 product patch
- https://www.netgear.com/support/product/raxe300 product patch
- https://kb.netgear.com/000070355/NETGEAR-Security-Advisories-November-2025 vendor-advisory