--- id: CVE-2026-9212 title: Insufficient authentication and input validation in certain NETGEAR products summary: "Insufficient authentication and input validation in the\_listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations." severity: medium cvss: 5.6 cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:U' cvssSource: cna cwe: - CWE-306 - CWE-20 vendor: NETGEAR product: LBR1020 affected: - LBR1020 < V2.6.4.60 - LBR20 < V2.7.6.8 - R6700AX <= * - R7800 < V1.0.4.96 - R9000 < V1.0.6.46 - RAX10 < V1.0.5.50 - RAX10v2 < V1.0.5.50 - RAX120 < V1.2.10.56 - RAX120v1 < V1.2.10.56 - RAX120v2 < V1.2.10.56 - RAX36S < V1.0.5.50 - RAX70 < V1.0.19.172 - RAX78 < V1.0.19.172 - RBR10 < 2.7.5.6 - RBR20 < 2.7.5.6 - RBR350 < V4.4.2.1 - RBR40 < 2.7.5.6 - RBR50 < 2.7.5.6 - RBS10 < 2.7.5.6 - RBS20 < 2.7.5.6 - RBS350 < V4.4.2.1 - RBS40 < 2.7.5.6 - RBS50 < 2.7.5.6 - XR450 < V2.3.3.136 - XR500 < v2.3.3.136 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-06-10T03:59:30.458680Z' published: '2026-06-09' updated: '2026-11-04' sourceUpdated: '2026-11-04T17:34:33.879Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-9212' references: - url: 'https://www.netgear.com/support/product/lbr20/' - url: 'https://www.netgear.com/support/product/lbr1020/' - url: 'https://www.netgear.com/support/product/r6700ax/' - url: 'https://www.netgear.com/support/product/r9000/' - url: 'https://www.netgear.com/support/product/r7800/' - url: 'https://www.netgear.com/support/product/rax10/' - url: 'https://www.netgear.com/support/product/rax120/' - url: 'https://www.netgear.com/support/product/rax78/' - url: 'https://www.netgear.com/support/product/rax120v2/' - url: 'https://www.netgear.com/support/product/rax70/' - url: 'https://www.netgear.com/support/product/rbr10/' - url: 'https://www.netgear.com/support/product/rbr350/' - url: 'https://www.netgear.com/support/product/rbr40/' - url: 'https://www.netgear.com/support/product/rbr50/' - url: 'https://www.netgear.com/support/product/rbs10/' - url: 'https://www.netgear.com/support/product/rbs20/' - url: 'https://www.netgear.com/support/product/rax36s/' - url: 'https://www.netgear.com/support/product/rbr20/' - url: 'https://www.netgear.com/support/product/rbs50/' - url: 'https://www.netgear.com/support/product/rbs350/' - url: 'https://www.netgear.com/support/product/xr500/' - url: 'https://www.netgear.com/support/product/rbs40/' - url: 'https://www.netgear.com/support/product/xr450/' - url: 'https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory' tags: - cve.org epss: 0.0027 epssPercentile: 0.19251 ingestedAt: '2026-11-05T21:36:00.467Z' --- ## Overview Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations. ## Affected - `LBR1020 < V2.6.4.60` - `LBR20 < V2.7.6.8` - `R6700AX <= *` - `R7800 < V1.0.4.96` - `R9000 < V1.0.6.46` - `RAX10 < V1.0.5.50` - `RAX10v2 < V1.0.5.50` - `RAX120 < V1.2.10.56` - `RAX120v1 < V1.2.10.56` - `RAX120v2 < V1.2.10.56` - `RAX36S < V1.0.5.50` - `RAX70 < V1.0.19.172` - `RAX78 < V1.0.19.172` - `RBR10 < 2.7.5.6` - `RBR20 < 2.7.5.6` - `RBR350 < V4.4.2.1` - `RBR40 < 2.7.5.6` - `RBR50 < 2.7.5.6` - `RBS10 < 2.7.5.6` - `RBS20 < 2.7.5.6` - `RBS350 < V4.4.2.1` - `RBS40 < 2.7.5.6` - `RBS50 < 2.7.5.6` - `XR450 < V2.3.3.136` - `XR500 < v2.3.3.136` ## Remediation Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: ProductFixed VersionLBR1020 (EoS) Orbi 4GX AC1200 Dual-Band Mesh WiFi Router V2.6.4.60 https://www.netgear.com/support/product/lbr1020/ LBR20 Orbi LTE Tri-band WiFi Router V2.7.6.8 https://www.netgear.com/support/product/lbr20/ R6700AX (EoS) 4-Stream AX1800 WiFi 6 RouterEOSR7800 (EoS) Nighthawk X4S AC2600 Smart WiFi Router V1.0.4.96 https://www.netgear.com/support/product/r7800/ R9000 (EoS) Nighthawk X10 AD7200 Smart WiFi Router V1.0.6.46 https://www.netgear.com/support/product/r9000/ RAX10 4-Stream AX1800 WiFi 6 Router V1.0.5.50 https://www.netgear.com/support/product/rax10/ RAX10v2V1.0.5.50RAX120 (EoS) Nighthawk AX12 12-Stream WiFi Router V1.2.10.56 https://www.netgear.com/support/product/rax120/ RAX120v1 (EoS)V1.2.10.56RAX120v2 Nighthawk AX12 12-Stream AX6000 WiFi Router V1.2.10.56 https://www.netgear.com/support/product/rax120v2/ RAX36S Nighthawk AX4 4-Stream AX3000 WiFi Router V1.0.5.50 https://www.netgear.com/support/product/rax36s/ RAX70 Nighthawk Tri-band AX8 8-Stream AX6600 WiFi 6 Router V1.0.19.172 https://www.netgear.com/support/product/rax70/ RAX78 Nighthawk AX8 8-Stream AX6200 Tri-Band WiFi Router V1.0.19.172 https://www.netgear.com/support/product/rax78/ RBR10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr10 RBR20 (EoS) Orbi AC2200 Tri-band WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr20 RBR350 Orbi AX1800 WiFi 6 Dual-band Mesh Router V4.4.2.1 https://www.netgear.com/support/product/rbr350/ RBR40 (EoS) Orbi AC2200 Tri-band WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr40 RBR50 (EoS) Orbi AC3000 Tri-band WiFi Router V2.7.5.6 https://www.netgear.com/support/product/rbr50 RBS10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs10 RBS20 (EoS) Orbi AC2200 Tri-band WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs20 RBS350 Orbi AX1800 WiFi 6 Dual-band Mesh Add-on Satellite V4.4.2.1 https://www.netgear.com/support/product/rbs350/ RBS40 (EoS) Orbi AC2200 Tri-band WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs40 RBS50 (EoS) Orbi AC3000 Tri-band WiFi Add-on Satellite V2.7.5.6 https://www.netgear.com/support/product/rbs50 XR450 (EoS) Nighthawk Pro Gaming Router V2.3.3.136 https://www.netgear.com/support/product/xr450/ XR500 (EoS) Nighthawk Pro Gaming Router v2.3.3.136 https://www.netgear.com/support/product/xr500/ Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.