CVE-2026-0419 Insufficient input validation vulnerability in NETGEAR JR6150
Local WiFi users can execute OS commands on the NETGEAR JR6150 router due to insufficient input validation, requiring device replacement as support ended.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0419?
CVE-2026-0419 is a medium-severity command injection vulnerability in Netgear Jr6150 Firmware, published on 9 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no further security updates are planned. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure continued security support and updates.
This vulnerability has been identified through firmware emulation in a controlled research environment and has not been verified on production hardware.
Weakness: CWE-20
Which versions are affected by CVE-2026-0419?
It affects 1 product.
Products include Netgear Jr6150 Firmware.
How do I fix CVE-2026-0419?
No fix has been published for CVE-2026-0419 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-0419 being exploited?
There is no known exploitation of CVE-2026-0419 in the wild and no public exploit code.
Other vulnerabilities in Netgear Jr6150 Firmware
Sources
Also known as GHSA-whpf-5jfj-q9v4.