CVE-2026-9211

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
NETGEAR	CAX30	< V2.2.1.4
NETGEAR	RAX30	< V1.0.10.94
NETGEAR	RAX5	< V1.0.5.34
NETGEAR	RAXE300	< V1.0.10.72

References

https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-AdvisoryVendor Advisory
https://www.netgear.com/support/product/cax30/Product
https://www.netgear.com/support/product/rax30/Product
https://www.netgear.com/support/product/rax5/Product
https://www.netgear.com/support/product/raxe300/Product

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-921145.3A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/ba CVE-2026-921158.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.0 CVE-2026-921169.1OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to CVE-2026-921199.1REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to up CVE-2026-92128.0Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands CVE-2026-921209.1OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended t CVE-2026-921217.5In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" fla CVE-2026-921228.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed CVE-2026-921238.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, p CVE-2026-921248.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a CVE-2026-921258.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing atta CVE-2026-921268.5Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an