Description
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NETGEAR | EX3700 | < V1.0.0.102 | V1.0.0.102 |
| NETGEAR | EX6120 | < V1.0.1.74 | V1.0.1.74 |
References
- https://www.netgear.com/support/product/ex3700 product patch
- https://www.netgear.com/support/product/ex6120 product patch
- https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory vendor-advisory patch