CVE-2026-9212

Insufficient authentication and input validation in certain NETGEAR products

Published Jun 9, 2026 CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Description
Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Remediation

Vendor Solution

Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: ProductFixed VersionLBR1020 (EoS) Orbi 4GX AC1200 Dual-Band Mesh WiFi Router V2.6.4.60 https://www.netgear.com/support/product/lbr1020/ LBR20 Orbi LTE Tri-band WiFi Router V2.7.6.8 https://www.netgear.com/support/product/lbr20/ R6700AX (EoS) 4-Stream AX1800 WiFi 6 RouterEOSR7800 (EoS) Nighthawk X4S AC2600 Smart WiFi Router V1.0.4.96 https://www.netgear.com/support/product/r7800/ R9000 (EoS) Nighthawk X10 AD7200 Smart WiFi Router V1.0.6.46 https://www.netgear.com/support/product/r9000/ RAX10 4-Stream AX1800 WiFi 6 Router V1.0.5.50 https://www.netgear.com/support/product/rax10/ RAX10v2V1.0.5.50RAX120 (EoS) Nighthawk AX12 12-Stream WiFi Router V1.2.10.56 https://www.netgear.com/support/product/rax120/ RAX120v1 (EoS)V1.2.10.56RAX120v2 Nighthawk AX12 12-Stream AX6000 WiFi Router V1.2.10.56 https://www.netgear.com/support/product/rax120v2/ RAX36S Nighthawk AX4 4-Stream AX3000 WiFi Router V1.0.5.50 https://www.netgear.com/support/product/rax36s/ RAX70 Nighthawk Tri-band AX8 8-Stream AX6600 WiFi 6 Router V1.0.19.172 https://www.netgear.com/support/product/rax70/ RAX78 Nighthawk AX8 8-Stream AX6200 Tri-Band WiFi Router V1.0.19.172 https://www.netgear.com/support/product/rax78/ RBR10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr10 RBR20 (EoS) Orbi AC2200 Tri-band WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr20 RBR350 Orbi AX1800 WiFi 6 Dual-band Mesh Router V4.4.2.1 https://www.netgear.com/support/product/rbr350/ RBR40 (EoS) Orbi AC2200 Tri-band WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr40 RBR50 (EoS) Orbi AC3000 Tri-band WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr50 RBS10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs10 RBS20 (EoS) Orbi AC2200 Tri-band WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs20 RBS350 Orbi AX1800 WiFi 6 Dual-band Mesh Add-on Satellite V4.4.2.1 https://www.netgear.com/support/product/rbs350/ RBS40 (EoS) Orbi AC2200 Tri-band WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs40 RBS50 (EoS) Orbi AC3000 Tri-band WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs50 XR450 (EoS) Nighthawk Pro Gaming Router V2.3.3.136 https://www.netgear.com/support/product/xr450/ XR500 (EoS) Nighthawk Pro Gaming Router v2.3.3.136 https://www.netgear.com/support/product/xr500/ Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting product's confidentiality or change certain configurations. Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Netgear
Netgear lbr1020
Netgear lbr20
Netgear r6700ax
Netgear r7800
Netgear r9000
Netgear rax10
Netgear rax10v2
Netgear rax120
Netgear rax120v1
Netgear rax120v2
Netgear rax36s
Netgear rax70
Netgear rax78
Netgear rbr10
Netgear rbr20
Netgear rbr350
Netgear rbr40
Netgear rbr50
Netgear rbs10
Netgear rbs20
Netgear rbs350
Netgear rbs40
Netgear rbs50
Netgear xr450
Netgear xr500
Vendors & Products Netgear
Netgear lbr1020
Netgear lbr20
Netgear r6700ax
Netgear r7800
Netgear r9000
Netgear rax10
Netgear rax10v2
Netgear rax120
Netgear rax120v1
Netgear rax120v2
Netgear rax36s
Netgear rax70
Netgear rax78
Netgear rbr10
Netgear rbr20
Netgear rbr350
Netgear rbr40
Netgear rbr50
Netgear rbs10
Netgear rbs20
Netgear rbs350
Netgear rbs40
Netgear rbs50
Netgear xr450
Netgear xr500
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting product's confidentiality or change certain configurations.
Title Insufficient authentication and input validation in certain NETGEAR products
Weaknesses CWE-20
CWE-306
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:U'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
NETGEAR
Published
Updated
Nov 4, 2026, 5:34 PM
Reserved
May 21, 2026, 5:29 PM
Status
Analyzed
Published
Jun 9, 2026, 5:17 PM
Modified
Nov 4, 2026, 6:17 PM