Junglewise Threat Intelligence

CVE-2026-9210: NETGEAR multiple router models improper input validation

CVE-2026-9210 · Severity: info · CVSS 4.9 · Published 2026-06-09

Technologies: NETGEAR RAX40v2, NETGEAR RAX20, NETGEAR RAX45, NETGEAR RAX42, NETGEAR RAX41, NETGEAR R7000, NETGEAR MS60, NETGEAR RAXE450, NETGEAR MS80, NETGEAR MR60, NETGEAR RAX48, NETGEAR MR80, NETGEAR RAX50, NETGEAR RAX43, NETGEAR RAXE500, NETGEAR XR1000, NETGEAR MR70, NETGEAR RAX35v2, NETGEAR R7000P, NETGEAR MS70, NETGEAR RAX50s. Vendors: NETGEAR.

Executive brief

A security vulnerability has been identified in several NETGEAR router and mesh system models. This flaw allows an individual with administrative access who is connected to the local network to make unauthorized changes to the device's software and core functions. While this requires existing administrative credentials, it could allow a malicious insider or a compromised admin account to permanently alter how the router operates.

Technical details

A vulnerability classified as Improper Input Validation (CWE-20) exists in the firmware of numerous NETGEAR networking products, including Nighthawk and Orbi series routers. The flaw allows an authenticated administrator, when connected via the adjacent network (local network), to bypass intended restrictions and modify router software or functionality. While the CVSS vector provided by the vendor suggests no privileges (PR:N) in the string, the descriptive text explicitly states the attacker must be an 'authenticated administrator.' Successful exploitation could lead to persistent unauthorized changes to the device's operating environment. Users are advised to check NETGEAR's support pages for specific firmware updates for their respective models.

Affected products

  • NETGEAR EX3700
  • NETGEAR EX3800
  • NETGEAR EX6120
  • NETGEAR EX6130
  • NETGEAR MR60
  • NETGEAR MR70
  • NETGEAR MR80
  • NETGEAR MS60
  • NETGEAR MS70
  • NETGEAR MS80
  • NETGEAR R6400v2
  • NETGEAR R6700v3
  • NETGEAR R6900P
  • NETGEAR R7000
  • NETGEAR R7000P
  • NETGEAR R7960P
  • NETGEAR R8000P
  • NETGEAR R8500
  • NETGEAR RAX20
  • NETGEAR RAX35v2
  • NETGEAR RAX40v2
  • NETGEAR RAX41
  • NETGEAR RAX42
  • NETGEAR RAX43
  • NETGEAR RAX45
  • NETGEAR RAX48
  • NETGEAR RAX50
  • NETGEAR RAX50S
  • NETGEAR RAXE450
  • NETGEAR RAXE500
  • NETGEAR XR1000

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory

References