What’s Vulnerable › Vulnerabilities
CVE-2026-9212: Insufficient authentication and input validation in certain NETGEAR products
- Severity: high (CVSS 8.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-09 · updated 2026-07-23
- Weakness: CWE-20
Description
Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.
Affected products
- NETGEAR Lbr1020 Firmware: before 2.6.4.60 — fixed in 2.6.4.60
- NETGEAR Lbr20 Firmware: before 2.7.6.8 — fixed in 2.7.6.8
- NETGEAR R6700Ax Firmware: all versions
- NETGEAR R7800 Firmware: before 1.0.4.96 — fixed in 1.0.4.96
- NETGEAR R9000 Firmware: before 1.0.6.46 — fixed in 1.0.6.46
- NETGEAR Rax10 Firmware: before 1.0.5.50 — fixed in 1.0.5.50
- NETGEAR Rax120 Firmware: before 1.2.10.56 — fixed in 1.2.10.56
- NETGEAR Rax36S Firmware: before 1.0.5.50 — fixed in 1.0.5.50
- NETGEAR Rax70 Firmware: before 1.0.19.172 — fixed in 1.0.19.172
- NETGEAR Rax78 Firmware: before 1.0.19.172 — fixed in 1.0.19.172
- NETGEAR Rbr10 Firmware: all versions
- NETGEAR Rbr20 Firmware: all versions
- NETGEAR Rbr350 Firmware: before 4.4.2.1 — fixed in 4.4.2.1
- NETGEAR Rbr40 Firmware: all versions
- NETGEAR Rbr50 Firmware: all versions
- NETGEAR Rbs10 Firmware: all versions
- NETGEAR Rbs20 Firmware: all versions
- NETGEAR Rbs350 Firmware: before 4.4.2.1 — fixed in 4.4.2.1
- NETGEAR Rbs40 Firmware: all versions
- NETGEAR Rbs50 Firmware: all versions
- NETGEAR Xr450 Firmware: before 2.3.3.136 — fixed in 2.3.3.136
- NETGEAR Xr500 Firmware: before 2.3.3.136 — fixed in 2.3.3.136
How to fix
Upgrade to a fixed version: NETGEAR Lbr1020 Firmware 2.6.4.60; NETGEAR Lbr20 Firmware 2.7.6.8; NETGEAR R7800 Firmware 1.0.4.96; NETGEAR R9000 Firmware 1.0.6.46; NETGEAR Rax10 Firmware 1.0.5.50; NETGEAR Rax120 Firmware 1.2.10.56; NETGEAR Rax36S Firmware 1.0.5.50; NETGEAR Rax70 Firmware 1.0.19.172; NETGEAR Rax78 Firmware 1.0.19.172; NETGEAR Rbr350 Firmware 4.4.2.1; NETGEAR Rbs350 Firmware 4.4.2.1; NETGEAR Xr450 Firmware 2.3.3.136. Check the vendor advisory for mitigations.
References
- https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
- https://www.netgear.com/support/product/lbr1020/
- https://www.netgear.com/support/product/lbr20/
- https://www.netgear.com/support/product/r6700ax/
- https://www.netgear.com/support/product/r7800/
- https://www.netgear.com/support/product/r9000/
- https://www.netgear.com/support/product/rax10/
- https://www.netgear.com/support/product/rax120/
- https://www.netgear.com/support/product/rax120v2/
- https://www.netgear.com/support/product/rax36s/
- https://www.netgear.com/support/product/rax70/
- https://www.netgear.com/support/product/rax78/
Get alerted when CVE-2026-9212 or the next vulnerability affects your stack