Skip to content
statance
MenuClose
Log inStart for free ↗
medium · CVSS 5.6

CVE-2026-9212

Insufficient authentication and input validation in certain NETGEAR products

Published 9 Jun 2026 · Source updated 4 Nov 2026 · Retrieved 2026-11-04 18:25 UTC

Monitor this CVE ↗Full CVE monitoring on Pro and Business

What happened?

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Description supplied by CVE Program. Formatting is simplified; follow the original advisory for full details.

Affected software and versions

Source-provided software and version information
SoftwareVersion informationFixed version
LBR1020NETGEARaffected: 0 to < V2.6.4.60See vendor advisory
LBR20NETGEARaffected: 0 to < V2.7.6.8See vendor advisory
R6700AXNETGEARaffected: 0 to ≤ *See vendor advisory
R7800NETGEARaffected: 0 to < V1.0.4.96See vendor advisory
R9000NETGEARaffected: 0 to < V1.0.6.46See vendor advisory
RAX10NETGEARaffected: 0 to < V1.0.5.50See vendor advisory
RAX10v2NETGEARaffected: 0 to < V1.0.5.50See vendor advisory
RAX120NETGEARaffected: 0 to < V1.2.10.56See vendor advisory
RAX120v1NETGEARaffected: 0 to < V1.2.10.56See vendor advisory
RAX120v2NETGEARaffected: 0 to < V1.2.10.56See vendor advisory
RAX36SNETGEARaffected: 0 to < V1.0.5.50See vendor advisory
RAX70NETGEARaffected: 0 to < V1.0.19.172See vendor advisory
RAX78NETGEARaffected: 0 to < V1.0.19.172See vendor advisory
RBR10NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
RBR20NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
RBR350NETGEARaffected: 0 to < V4.4.2.1See vendor advisory
RBR40NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
RBR50NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
RBS10NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
RBS20NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
RBS350NETGEARaffected: 0 to < V4.4.2.1See vendor advisory
RBS40NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
RBS50NETGEARaffected: 0 to < 2.7.5.6See vendor advisory
XR450NETGEARaffected: 0 to < V2.3.3.136See vendor advisory
XR500NETGEARaffected: 0 to < v2.3.3.136See vendor advisory

Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.

Is it being exploited?

This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.

CISA data retrieved 2026-11-06 16:38 UTC. Check CISA ↗

How to respond

  1. Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
  2. Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
  3. Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.

Sources and remediation references

This public advisory does not determine whether a particular server is affected. Records are refreshed as sources change; verify urgent decisions against the original advisory.

← Browse the public CVE feed