CVE-2026-0412: NETGEAR JR6150 Insufficient Input Validation (End-of-Life Router)

Technical summary

CVE-2026-0412 is an insufficient input validation vulnerability (CWE-20) affecting NETGEAR JR6150 AC750 WiFi routers. The flaw permits authenticated local administrators to perform unauthorized modifications to router firmware and configuration through unvalidated input vectors. The CVSS 3.1 score of 4.5 (MEDIUM) reflects the requirement for high-privilege local network access (AV:A, PR:H) combined with significant integrity impact (I:H) but no confidentiality or availability compromise. Notably, this vulnerability has been identified through firmware emulation in a controlled research environment and has not yet been confirmed on production hardware in the field.

Business impact

Organizations or small offices still deploying JR6150 routers face a compounded risk: the underlying vulnerability cannot be patched, and the device is entirely outside the vendor's support window. A malicious or compromised administrator could alter router firmware, potentially leading to persistent network compromise, traffic interception, or lateral movement into connected systems. The lack of any available patch and vendor recommendation to replace the device means the only mitigation is hardware replacement—a capital and operational burden that should drive migration planning immediately.

Affected systems

NETGEAR JR6150 AC750 WiFi Router (802.11ac Dual Band Gigabit) and its firmware. This device reached End-of-Support in 2018. Any organization still operating these routers in production is at risk; given their age, many may already be retired, but legacy deployments in branch offices, older branch locations, or lab environments warrant inventory review.

Exploitability

Exploitation requires administrative credentials and local network access, which significantly limits the practical attack surface in most enterprise settings. However, insider threats or compromised admin accounts pose real risk. The vulnerability is not known to be exploited in the wild, and exploitation is not tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog. Because the flaw was identified through firmware emulation rather than hardware testing, organizations should monitor for real-world exploit development but can reasonably assess this as lower urgency than actively exploited vulnerabilities.

Remediation

NETGEAR recommends replacing JR6150 devices with newer models that receive active security support. No patch will be released for this end-of-life device. Organizations should prioritize: (1) conducting inventory to identify all JR6150 units in production; (2) developing a replacement schedule; and (3) in interim high-risk scenarios, implementing additional network segmentation and access controls to limit administrative access to the router and monitor for unauthorized configuration changes.

Patch guidance

No patch is available and no patch will be issued. NETGEAR has explicitly stated that users should replace these devices with supported models. Verify your NETGEAR router model against documentation, and if you are operating JR6150 units, initiate procurement and deployment of replacement equipment. Consult NETGEAR's current product lineup for suitable successors and obtain vendor advisories confirming security support timelines before purchase.

Detection guidance

Monitor administrative access logs on affected routers (if available in your firmware version) for suspicious login attempts or configuration changes. Enable NetFlow or similar network analytics on router interfaces to detect anomalous traffic patterns that may indicate compromised firmware. For organizations unable to immediately replace equipment, implement network access controls (firewall rules, VLAN isolation) that limit administrative access to the router to trusted jump hosts or administrative networks only. Segment user traffic away from administrative interfaces using separate networks where feasible.

Why prioritize this

Although the CVSS score is MEDIUM (4.5) and exploitation requires administrative access, the critical context is that no patch exists and no patch will exist—the device is end-of-life. This shifts the priority from 'patch urgently' to 'replace in planned lifecycle.' For organizations still running JR6150 devices, remediation requires capital expenditure and operational effort. Prioritize replacement in any environment handling sensitive data, regulated workloads, or where insider risk is elevated. For low-sensitivity environments, remediation may be scheduled as part of routine hardware refresh, but inventory and assessment should happen now.

Risk score, explained

The CVSS 3.1 score of 4.5 reflects the attack vector (local network, not remote), requirement for high privilege (admin), and absence of confidentiality or availability impact. However, this score alone does not capture the severity of an unfixable vulnerability in network infrastructure. The risk is significantly elevated by: (1) the end-of-life status, eliminating patch-based remediation; (2) the router's role in network access control, making firmware tampering a potential turning point for broader compromise; and (3) the presence of insider threat vectors (admin compromise). Organizations should treat this as a high-priority replacement target despite the modest numerical CVSS score.

Frequently asked questions