CVE-2026-9210

MediumCVSS 4.5/10Last modified Jul 23, 2026

Description

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
NETGEAREX3700< V1.0.0.100
NETGEAREX3800< V1.0.0.100
NETGEAREX6120< V1.0.0.72
NETGEAREX6130< V1.0.0.54
NETGEARMR60< V1.1.7.132
NETGEARMR70< V1.0.3.28
NETGEARMR80< V1.1.7.14
NETGEARMS60< V1.1.7.132
NETGEARMS70< V1.0.3.28
NETGEARMS80< V1.1.7.14
NETGEARR6400v2< V1.0.4.128
NETGEARR6700v3< V1.0.4.128
NETGEARR6900P< V1.3.3.152
NETGEARR7000< V1.0.11.216
NETGEARR7000P< V1.3.3.152
NETGEARR7960P< V1.4.4.92
NETGEARR8000P< V1.4.4.92
NETGEARR8500<= 1.0.2.160
NETGEARRAX20< V1.0.18.144
NETGEARRAX35v2< V1.0.12.118
NETGEARRAX40v2< V1.0.12.118
NETGEARRAX41< V1.0.12.118
NETGEARRAX42< V1.0.12.118
NETGEARRAX43< V1.0.12.120
NETGEARRAX45< V1.0.12.118
NETGEARRAX48< V1.0.12.118
NETGEARRAX50< V1.0.12.120
NETGEARRAX50S< V1.0.12.120
NETGEARRAXE450< V1.0.10.86
NETGEARRAXE500< V1.0.10.86
NETGEARXR1000< V1.0.0.68

References

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-921036.3Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hCVE-2026-921062.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSCVE-2026-92118.8An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.CVE-2026-921145.3A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/baCVE-2026-921158.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.0CVE-2026-921169.1OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to CVE-2026-921199.1REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upCVE-2026-92128.0Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commandsCVE-2026-921209.1OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended tCVE-2026-921217.5In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flaCVE-2026-921228.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxedCVE-2026-921238.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, p
CVE-2026-9210: Medium severity, CVSS 4.5 | Vulnix