--- title: "Netgear router security update: models and fixes" description: "Check the netgear router security update, fixed firmware versions, installation steps, EoS guidance and why a VPN cannot repair vulnerable hardware." url: "https://tunnelverdict.com/blog/netgear-router-extender-security-update/" lang: "en" published: "2026-10-29" modified: "2026-10-29" tags: ["security","setup","router","news"] image: "https://tunnelverdict.com/blog/netgear-router-extender-security-update/featured.jpg" alternates: es: "https://tunnelverdict.com/es/blog/actualizacion-de-seguridad-routers-netgear.md" --- News # Netgear Patches Three Router and Extender Flaws: Who Should Update Check the netgear router security update, fixed firmware versions, installation steps, EoS guidance and why a VPN cannot repair vulnerable hardware. Tunnel Verdict Published October 29, 2026 ![A home Wi-Fi router with antennas on a hallway shelf beside a small plant](https://tunnelverdict.com/blog/netgear-router-extender-security-update/featured.jpg) If you own a NETGEAR CAX30, RAX28, RAX29, RAX30, RAX5, RAXE300, EX3700 or EX6120 anywhere in the world, identify the model and installed firmware before deciding what to do next. As of October 29, 2026, NETGEAR has fixed three medium-severity flaws affecting those products, and the first step is to compare your firmware with the fixed version. PCWorld reported the patches on October 29, 2026. NETGEAR’s security advisory, last updated October 28, 2026, says to install available firmware promptly and enable automatic firmware updates where supported. The flaws are described as requiring network-adjacent or local-network access, not unrestricted attacks from anywhere on the internet. Key takeaways - Check the model number and installed firmware before choosing an update or replacement. - CAX30, RAX28, RAX29, RAX30, RAX5, RAXE300, EX3700 and EX6120 are included in the three main flaws. - Install the fixed firmware through the Nighthawk app, Orbi app or device web interface. - Check the firmware version again after the router or extender restarts. - A VPN does not repair vulnerable router firmware or replace a security update. - NETGEAR marks RAX5 and EX3700 as EoS, so compare replacement models and support terms before paying. ## Is Your NETGEAR Router or Extender on the October 2026 List? As of October 29, 2026, the three main NETGEAR flaws affect eight product models sold for home and small-office use in multiple regions, including the United States. The affected products are the CAX30, RAX28, RAX29, RAX30, RAX5, RAXE300, EX3700 and EX6120. ![A hand turning a home router over to look at the underside on a kitchen counter](https://tunnelverdict.com/blog/netgear-router-extender-security-update/router-underside-label.jpg) The model number matters more than the product family name. A label on the underside or back of the router or extender may show the exact model. You can also find it on the product packaging or in the administration page. Record that model number before deciding whether a firmware update or replacement is needed. NETGEAR also lists additional vulnerabilities in the October 2026 advisory. Those affect the CBR40, R7000, R7000P, RAX40 and R7300DST. The CBR40 and R7300DST are marked EoS, meaning End-of-Support. NETGEAR says no security updates are planned for EoS products and recommends retiring affected devices. The three main flaws do not mean every NETGEAR router is affected. They apply to the exact models listed above and to the firmware conditions described by NETGEAR. For example, CVE-2026-11732 affects the CAX30, RAX30, RAX5 and RAXE300 when the Block Sites feature is enabled. If your product is not on the list, keep checking the model’s support page and release notes. If you use NETGEAR equipment in the United States, Mexico, Europe or another region, the model and firmware comparison still comes first because the advisory covers products rather than a single country. ## What the Three Flaws Let an Attacker Do As of October 29, 2026, NETGEAR classifies all three main flaws as medium severity. The documented attack conditions involve access to the local network or a nearby management service. That could include a person who has access to the same Wi-Fi network, but the advisory does not describe these three flaws as unrestricted internet attacks. ![A small range extender plugged into a wall socket at the top of a staircase](https://tunnelverdict.com/blog/netgear-router-extender-security-update/extender-in-wall-socket.jpg) CVE-2026-11732 affects the CAX30, RAX30, RAX5 and RAXE300 when Block Sites is enabled. A network-adjacent attacker with network access could run unauthorized commands through that feature. Disabling Block Sites may remove the specific condition described for that feature, but it is not a substitute for installing the firmware fix. CVE-2026-11731 affects the RAX28, RAX29 and RAX30. NETGEAR says an unauthenticated attacker with adjacent access to the management service could access certain device information or change administrative settings. That does not mean every setting or every account is exposed, but administrative changes can affect how a router operates. CVE-2026-11730 affects the EX3700 and EX6120 WiFi range extenders. An attacker with network access could predict valid session identifiers and hijack an authenticated web-administrator session. In ordinary language, the flaw could allow an attacker to take over an existing administrator session without first signing in normally. These descriptions apply to the products and advisory dated October 28 and October 29, 2026. The stated medium severity is NETGEAR’s classification. You can consult the live CVE and NVD records later for any scoring or additional details published after those dates. ## The Fixed Firmware Version for Each Affected Model The fixed versions below are the versions NETGEAR lists in its October 2026 advisory. Compare the exact model and installed firmware on your device before installing anything. A version number that looks similar may belong to another model or another vulnerability. | Vulnerability | Affected products | Effect described by NETGEAR | Severity | Fixed firmware | | --- | --- | --- | --- | --- | | CVE-2026-11732 | CAX30, RAX30, RAX5, RAXE300 | Unauthorized commands through Block Sites when enabled | Medium | CAX30 V2.3.4.12; RAX30 V1.0.14.108; RAX5 V1.0.5.34; RAXE300 V1.0.10.72 | | CVE-2026-11731 | RAX28, RAX29, RAX30 | Access to certain device information or changes to administrative settings | Medium | RAX28 v1.0.15.110; RAX29 v1.0.15.110; RAX30 v1.0.15.110 | | CVE-2026-11730 | EX3700, EX6120 | Session identifier prediction and authenticated administrator-session hijacking | Medium | EX3700 V1.0.0.102; EX6120 V1.0.1.74 | The RAX30 appears in two rows because NETGEAR lists it for both CVE-2026-11732 and CVE-2026-11731, with different fixed versions. Check the installed firmware against the latest version NETGEAR offers for your RAX30 rather than stopping after one update. NETGEAR says devices with automatic updates enabled may already have received the patch as of October 29, 2026. You should still check the installed firmware after restarting. The update fixes the documented vulnerability in the affected firmware, but it does not give an unsupported product future security support. The RAX5 and EX3700 are marked EoS in NETGEAR’s table. If your device is EoS, compare the exact replacement model, supported features and current support terms before paying. A newer device may be the practical choice when continued security updates matter. ## How to Check and Install the NETGEAR Update Today Start by writing down the model number and current firmware version. Keep the device powered on during the installation, and do not close the update page or interrupt the restart. ![A laptop linked to a router by a short Ethernet cable on a desk](https://tunnelverdict.com/blog/netgear-router-extender-security-update/ethernet-laptop-router.jpg) For a router using the web interface: 1. Connect a computer to the router, preferably with Ethernet. 2. Open `routerlogin.net`. 3. Sign in with the router administrator credentials. 4. Open Advanced, Administration, or Settings, Administration. 5. Select Firmware Update or Router Update. 6. Select Check. 7. If firmware is available, select Yes and Upgrade. 8. Wait for the router to restart and the connection to return. The names can vary by model and firmware version in the United States and other regions. Review the model’s release notes before starting, especially if NETGEAR presents more than one available version. For a Nighthawk router, connect your phone to the router’s Wi-Fi and open the Nighthawk app. Sign in to the MyNETGEAR account if the app asks, then enter the router administrator credentials. Open the router settings, select Check for Updates and choose Update when new firmware appears. Wait for the router to restart before closing the app. For an Orbi system, connect your phone to the Orbi Wi-Fi network and open the Orbi app. Sign in with the router administrator password, then select Menu, Settings, Router Settings and Check for Updates or Update Firmware. Follow the onscreen instructions and allow the system to restart. For an extender, connect to the extender’s Wi-Fi network and open `mywifiext.net`. If the extender shares the router’s SSID, use the extender’s IP address instead. Sign in, select Firmware Update and then Check Online. Follow the instructions until the extender finishes restarting. A manual upload is another option when the app or online check does not present the right firmware. Download the exact model’s firmware from NETGEAR Support, then use the device’s Firmware Update page to upload the `.img` or `.chk` file. Do not upload firmware for a similar model, and do not interrupt the process. After the device comes back online, sign in again and check the firmware version. Confirm normal connectivity on your phone, computer, television and other connected devices. If supported, enable automatic firmware updates. If the update temporarily interrupts your connection, use NETGEAR’s normal restart and reconnection steps rather than switching to a VPN as a substitute for the firmware fix. Update a NETGEAR router through the web interface 1. Connect a computerConnect a computer to the router, preferably with Ethernet. 2. Open routerlogin.netOpen routerlogin.net in a browser. 3. Sign inSign in with the router administrator credentials. 4. Open the administration pageOpen Advanced, Administration, or Settings, Administration. 5. Choose the updateSelect Firmware Update or Router Update, then select Check. 6. Install if availableIf firmware is available, select Yes and Upgrade. 7. Wait for the restartWait for the router to restart and the connection to return. 8. Check the versionSign in again and check the installed firmware version. ## What EoS Means for RAX5, EX3700 and Other Older Devices EoS means NETGEAR has placed the product in its End-of-Support phase. In the October 2026 advisory, NETGEAR says no security updates are planned for EoS products and recommends retiring affected devices. ![An older router with tangled cables in a cardboard box on a garage shelf](https://tunnelverdict.com/blog/netgear-router-extender-security-update/old-router-in-box.jpg) The RAX5 and EX3700 are listed as EoS even though NETGEAR provides fixed versions for the flaws above. That means installing the listed firmware addresses the documented issue, but it does not promise another update later. The CBR40 and R7300DST are also marked EoS in the advisory, and NETGEAR lists them as “Won’t Fix” for the additional issues described there. Before paying for replacement hardware, compare the exact model, Wi-Fi standard, coverage, modem compatibility and current support terms. If the device belongs to an employer, landlord or service provider, ask the owner or administrator about replacement plans. Limit updates and troubleshooting to equipment you own or are authorized to administer. ## Why a VPN Does Not Fix a Vulnerable Router A VPN is a separate privacy tool, not a firmware repair. A VPN app encrypts the connection between your device and the VPN server and changes the IP address that websites see. It does not replace the router’s operating software, remove a vulnerable management interface or repair CVE-2026-11732, CVE-2026-11731 or CVE-2026-11730. A VPN client installed directly on a router also runs on that router. It may change the path used by internet traffic, but it does not patch the router’s firmware. Install the NETGEAR update first, then decide whether you want a VPN for a separate purpose, such as protecting traffic on public Wi-Fi or changing the apparent source IP address. A VPN also does not prevent accounts, cookies or device fingerprints from identifying you. It works alongside firmware updates, strong account security and phishing protection. If you are deciding between a VPN on the router and VPN apps on individual devices, use [VPN on your router or your devices](https://tunnelverdict.com/blog/vpn-on-router-vs-device/) as the next step. ## Legal, Safety and Follow-Up Considerations NETGEAR’s advisory tells owners to install the applicable firmware, enable automatic updates where supported and retire EoS devices for which security updates are not planned. It does not authorize bypassing access controls, testing another person’s router or attempting to exploit the flaws. Limit update and troubleshooting activity to equipment you own or administer with permission. Consult local law before testing security features, scanning networks or examining devices outside your control. The law where you are located, along with the service terms that apply to your network or VPN, determines what activity is allowed. Watch for later changes in the live CVE and NVD records, revised NETGEAR release notes, and new firmware notices for related models. If your device remains unsupported, compare replacement cost and compatibility before disposing of it. **Quiz: Comprueba lo aprendido** 1. Al 29 de octubre de 2026, ¿qué tipo de acceso dice NETGEAR que requieren los tres fallos principales? - Acceso sin restricciones desde cualquier punto de internet - Acceso desde una red adyacente o desde la red local **(correct answer)** - Solo acceso físico al router 2. ¿Una VPN repara el firmware vulnerable del router? - Sí, una vez instalada en un teléfono - Sí, pero solo si se ejecuta en el router - No; la actualización del firmware es lo que corrige el fallo documentado **(correct answer)** 3. ¿Qué dice el aviso de octubre de 2026 de NETGEAR sobre los productos en EoS? - Se planean actualizaciones de seguridad para más adelante - No se planean actualizaciones de seguridad y recomienda retirar los dispositivos afectados **(correct answer)** - Solo reciben actualizaciones en Estados Unidos ## Frequently asked questions The answers below address the next decisions for owners in the United States and elsewhere as of October 29, 2026. ### Do I need to update a NETGEAR router if I do not use Block Sites? Yes, update the device if it is one of the affected models. Block Sites is part of the described condition for CVE-2026-11732, but the other listed flaws have different conditions, and disabling one feature does not replace the firmware fix. ### Can someone exploit these NETGEAR flaws from anywhere on the internet? NETGEAR describes the three main flaws as requiring network-adjacent or local-network access. The October 2026 advisory does not describe them as unrestricted attacks from anywhere on the internet, but a local or office network can still contain people or devices you do not fully control. ### How do I know whether my NETGEAR update worked? Sign in after the router or extender restarts and check the installed firmware version again. Compare it with the fixed version for the exact model, then confirm normal connectivity on your usual devices. ### Should I replace my RAX5 or EX3700 immediately? Replace it if NETGEAR marks the device EoS and no future security updates are planned, but compare the exact replacement model and current support terms before paying. Install the listed fixed firmware first if it is available and your device is still operating normally. ### Can a VPN protect me while I wait for the NETGEAR update? No. A VPN encrypts traffic between a device and the VPN server, but it does not patch router firmware or stop an attacker with the required local-network access from targeting the router or extender. ### Will automatic firmware updates install the October 2026 fix? They may already have installed it on supported devices with automatic updates enabled. Check the firmware version manually after the restart because the setting does not remove the need to confirm that the correct version is installed. ### What should I do if my router will not reconnect after the update? Wait for the restart to finish, then check the router’s lights and reconnect your phone or computer to Wi-Fi. If the problem continues, follow NETGEAR’s model-specific recovery steps and review the release notes, rather than assuming a VPN will restore the router. ### Is the RAX30 affected by one flaw or two? The RAX30 appears in both CVE-2026-11732 and CVE-2026-11731. NETGEAR lists V1.0.14.108 for the first issue and v1.0.15.110 for the second, so check the latest firmware offered for your exact RAX30. ### What does “medium severity” tell me? It is NETGEAR’s severity classification for the three main flaws as of October 2026. You can consult the live CVE and NVD records later for any subsequently published scoring or changed technical detail. ### Does a firmware update make an EoS device supported again? No. It fixes the documented issue in the listed firmware, but an EoS product remains outside NETGEAR’s planned security-update support. Compare replacement options if continued updates are part of your home or office security plan. ### What should I do if a website shows a VPN or proxy message after the update? First confirm that the router or extender has normal connectivity and that the firmware version is correct. If Netflix shows a proxy message, work through the [Netflix proxy error fixes](https://tunnelverdict.com/blog/netflix-vpn-proxy-error/) and treat that service issue separately from the NETGEAR security update. NETGEAR owners should begin with the model number, installed firmware and support status. A VPN may still fit your phone, Fire Stick, PS5 or other device for a separate privacy purpose, but the router update remains the first task for affected hardware. If you need a device-specific setup next, use [how to set up a VPN on an iPhone](https://tunnelverdict.com/blog/vpn-on-iphone/) or [how to set up a VPN on Windows 11](https://tunnelverdict.com/blog/vpn-on-windows-11/). ## Glossary **Firmware:** The router's or extender's operating software. A VPN does not replace it. **CVE:** The identifier assigned to each flaw, such as CVE-2026-11732. **Network-adjacent access:** Access to the local network or a nearby management service. NETGEAR describes the three main flaws as needing this kind of access. **Block Sites:** A router feature. CVE-2026-11732 affects the CAX30, RAX30, RAX5 and RAXE300 when it is enabled. **Session hijacking:** Taking over an existing administrator session without first signing in normally. CVE-2026-11730 describes this for the EX3700 and EX6120. **EoS:** End-of-Support. NETGEAR says no security updates are planned for EoS products. **Medium severity:** NETGEAR's classification for all three main flaws as of October 29, 2026. Find more VPN guides on [Tunnel Verdict](https://tunnelverdict.com/). Have a question about your own setup? [Contact us](https://tunnelverdict.com/contact/) and include your device and the VPN you use. - Security - Setup - Router - News Keep reading ## More VPN guides and reviews News ### [ExpressVPN for Android Adds Passkey and Token Sign-In](https://tunnelverdict.com/blog/expressvpn-android-passkey-login/) ExpressVPN passkey login android explained with setup steps, token sign-in, rollout limits, renewal checks, and refund details for your device. [Read ExpressVPN for Android Adds Passkey and Token Sign-In](https://tunnelverdict.com/blog/expressvpn-android-passkey-login/) Comparison ### [Best Travel Router for a VPN: GL.iNet Beryl, Slate and Mango](https://tunnelverdict.com/blog/best-travel-router-for-vpn/) Choose the best travel router for vpn use with clear picks for speed, price, hotel Wi-Fi, firmware, VPN providers and device setup. [Read Best Travel Router for a VPN: GL.iNet Beryl, Slate and Mango](https://tunnelverdict.com/blog/best-travel-router-for-vpn/) Comparison ### [Best Router With a Built-In VPN Client for Home](https://tunnelverdict.com/blog/best-vpn-router/) Find the best router with built in vpn client for home, compare VPN support, speed, device rules, setup choices, prices and renewal terms. [Read Best Router With a Built-In VPN Client for Home](https://tunnelverdict.com/blog/best-vpn-router/)