Roteadores NETGEAR · Disclosed

Seller claims pre-auth RCE zero-day in NETGEAR router

Oct 30, 2026 · 1 min read

A seller advertises on a forum a zero-day pre-authentication remote code execution flaw in a NETGEAR router. There is no CVE, specific model, NETGEAR confirmation, or disclosed fix. According to the seller, the flaw would grant full control of the router and network, with persistence that survives a factory reset; keep firmware updated and the admin interface off the internet until the claim is verified.

By HIFY Radar newsroom Updated 10/30/2026 08:12 AM Get this every day →← Back to the feed 1 source

MediumVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A seller advertises on a forum a zero-day pre-authentication remote code execution flaw in a NETGEAR router. According to the seller, it would grant full control of the router and the network. No model, CVE, vendor confirmation, or fix has been disclosed.

Why it matters

The router is the gateway for all traffic; according to the seller, the attack would allow redirecting employee browsing to fake pages, intercepting traffic, and stealing passwords, including network and ISP credentials. It is an unverified claim, but the potential damage is severe if confirmed. Any organization running NETGEAR routers is in the possible scope.

What to do

Update the firmware of all NETGEAR routers to the latest version. Keep the admin interface off the internet and change administrator and Wi-Fi passwords. Watch NETGEAR's official advisories until the claim is confirmed or denied.

For the technical team

Affected: Roteadores NETGEAR (modelo não especificado) · NETGEAR routers; model and versions unspecified.
Exploitation: No public PoC and no reported exploitation. Zero-day sale announced on a forum, reported by dbugs (via @ptdbugs).
Fix: No fix disclosed; NETGEAR has not commented in the sources.
Vector: NETGEAR router; pre-authentication remote code execution flaw, no login required. Model, version, and exposure condition not detailed by the seller.
More details: According to the seller, exploitation would expose the administrator password hash, Wi-Fi key, ISP and SMB credentials, and private TLS keys; it would allow redirecting network clients' DNS to attacker servers for phishing, intercepting traffic, and persisting via cron or firmware modification that survives a factory reset. The seller also cites adding the device to a botnet, using it to attack other IoT devices, and taking it offline.