Netgear RAX5 reaches end of service after final security patch for local network flaws

Netgear has issued firmware patches for several router models to address two medium severity vulnerabilities that could allow local network attackers to execute unauthorized commands or modify administrative settings. These updates are now available for download through the manufacturer’s website and via device settings, though one affected model has reached its end of service life.

The evidence

According to a report by ZDNet AI, certain Netgear routers contain security flaws that leave them susceptible to exploitation by attackers who gain access to the user’s network.reported The company has published a security advisory detailing the issues and has rolled out new firmware for each impacted model to resolve the bugs. ZDNet AI notes that while the vulnerabilities pose a threat, they affect only a small number of Netgear routers, and patches are already available.

The first vulnerability, identified as CVE-2026-11732, allows an attacker with network access to run unauthorized commands on the device.reported This flaw is exploitable only if the user has enabled the Block Sites feature, which restricts access to specific websites based on domain names or keywords. The second issue, CVE-2026-11731, permits an unauthenticated attacker on the local network to view and modify certain device details and administrative settings via the router’s management service.reported

The decision

ZDNet AI states that all the flaws are ranked as medium severity, prompting Netgear to issue firmware updates for every impacted model. Users can apply these patches directly through their router’s settings interface or by downloading the updates from Netgear’s website. The report emphasizes that while the severity is medium, the potential for unauthorized command execution still poses a clear threat to network security.

For the RAX5 4-Stream AX1600 WiFi 6 Router, Netgear has declared end of service status.reported This means that the current firmware update is the final one available for this model, and no further security patches will be released. Netgear advises owners of this specific router to upgrade to a newer model to maintain security and support.

The takeaway

The affected devices include the CAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router, the RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router, and the RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router.reported Each of these models requires the latest firmware to mitigate the risks associated with CVE-2026-11732 and CVE-2026-11731.

Users must ensure their routers are updated to protect against local network attackers who could exploit these flaws. The Block Sites feature on affected devices must be managed carefully, as its presence is a prerequisite for exploiting the command execution vulnerability. For devices that have reached end of service, replacing the hardware is the only option for continued security.

Building on this

Developers and enterprise IT buyers can use these documented capabilities to refine network access control policies and device lifecycle management strategies. The requirement for local network access to exploit CVE-2026-11732 and CVE-2026-11731 suggests that segmenting guest networks from administrative interfaces remains a valid mitigation strategy.reported The fact that the Block Sites feature enables the command execution flaw indicates that disabling unused features reduces the attack surface.

The end of service status for the RAX5 model provides a concrete data point for asset retirement planning. Developers can build tools that query router firmware versions against known end-of-life lists to flag devices that no longer receive security updates. The availability of patches for the CAX30, RAX30, and RAXE300 models allows automation scripts to verify compliance by checking for specific firmware versions. These interfaces and limits define the scope for building monitoring dashboards that track patch adoption rates across enterprise deployments.