CVE-2026-9212

HighCVSS 8.0/10Last modified Nov 4, 2026

Description

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-306

Affected software

VendorProductVersions
NETGEARLBR1020< V2.6.4.60
NETGEARLBR20< V2.7.6.8
NETGEARR6700AX<= *
NETGEARR7800< V1.0.4.96
NETGEARR9000< V1.0.6.46
NETGEARRAX10< V1.0.5.50
NETGEARRAX10v2< V1.0.5.50
NETGEARRAX120< V1.2.10.56
NETGEARRAX120v1< V1.2.10.56
NETGEARRAX120v2< V1.2.10.56
NETGEARRAX36S< V1.0.5.50
NETGEARRAX70< V1.0.19.172
NETGEARRAX78< V1.0.19.172
NETGEARRBR10< 2.7.5.6
NETGEARRBR20< 2.7.5.6
NETGEARRBR350< V4.4.2.1
NETGEARRBR40< 2.7.5.6
NETGEARRBR50< 2.7.5.6
NETGEARRBS10< 2.7.5.6
NETGEARRBS20< 2.7.5.6
NETGEARRBS350< V4.4.2.1
NETGEARRBS40< 2.7.5.6
NETGEARRBS50< 2.7.5.6
NETGEARXR450< V2.3.3.136
NETGEARXR500< v2.3.3.136

References

Timeline

Published
Jun 9, 2026
Last modified
Nov 4, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-921209.1OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended tCVE-2026-921217.5In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flaCVE-2026-921228.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxedCVE-2026-921238.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, pCVE-2026-921248.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from aCVE-2026-921258.8Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attaCVE-2026-921268.5Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an CVE-2026-921278.0Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when CVE-2026-921287.5Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of theCVE-2026-921297.5Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically toCVE-2026-92138.1A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the roCVE-2026-921303.1Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resol
CVE-2026-9212: High severity, CVSS 8.0 | Vulnix