What’s Vulnerable › Vulnerabilities

CVE-2026-9218: Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access

• Severity: medium (CVSS 4.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-16
• Weakness: CWE-20

Description

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.

Affected products

• NETGEAR CBR40: all versions
• NETGEAR R7000: before v1.0.11.130 — fixed in v1.0.11.130
• NETGEAR R7000P: before V1.3.3.152 — fixed in V1.3.3.152
• NETGEAR RAX40: before V1.0.3.64 — fixed in V1.0.3.64

How to fix

Upgrade to a fixed version: NETGEAR R7000 v1.0.11.130; NETGEAR R7000P V1.3.3.152; NETGEAR RAX40 V1.0.3.64. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory
• https://www.netgear.com/support/product/cbr40/
• https://www.netgear.com/support/product/r7000/
• https://www.netgear.com/support/product/r7000p/
• https://www.netgear.com/support/product/rax40/

Get alerted when CVE-2026-9218 or the next vulnerability affects your stack