CVE-2026-9216: Insufficient input validation vulnerability exists in certain NETGEAR RAX Models

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-10-13
Weakness: CWE-121

Description

An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.

Affected products

NETGEAR RAX30: before 1.0.9.92 — fixed in 1.0.9.92
NETGEAR Rax35 Firmware: before 1.0.10.72 — fixed in 1.0.10.72
NETGEAR Rax38 Firmware: before 1.0.6.106 — fixed in 1.0.6.106
NETGEAR Rax40 Firmware: before 1.0.6.106 — fixed in 1.0.6.106
NETGEAR Raxe300 Firmware: before 1.0.10.72 — fixed in 1.0.10.72

How to fix

Upgrade to a fixed version: NETGEAR RAX30 1.0.9.92; NETGEAR Rax35 Firmware 1.0.10.72; NETGEAR Rax38 Firmware 1.0.6.106; NETGEAR Rax40 Firmware 1.0.6.106; NETGEAR Raxe300 Firmware 1.0.10.72. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-9216 or the next vulnerability affects your stack