CVE-2026-11814: netgear be9300_firmware Improper Certificate Validation

Vulnerability summary

CVE-2026-11814 is a medium (CVSS 6.8) Improper Certificate Validation vulnerability in netgear be9300_firmware. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities.

Timeline

1. 11-08-2026
   PublishedVulnerability first disclosed.
2. 12-08-2026
   Last modifiedVulnerability information updated.

Description

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.

• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.