CVE-2026-9213

HighCVSS 8.1/10Last modified Jul 23, 2026

Description

A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
NETGEAR	MR70	< V1.0.4.48
NETGEAR	MS70	< V1.0.4.48
NETGEAR	RAXE500	< V1.2.14.114
NETGEAR	XR1000	< V1.0.2.86

References

https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-AdvisoryVendor Advisory
https://www.netgear.com/support/product/mr70/Product
https://www.netgear.com/support/product/ms70/Product
https://www.netgear.com/support/product/raxe500/Product
https://www.netgear.com/support/product/xr1000/Product

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-921303.1Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resol CVE-2026-921314.2Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline CVE-2026-921325.4Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, eve CVE-2026-921335.4Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials unde CVE-2026-921348.0Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitte CVE-2026-921358.0Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thr CVE-2026-921368.0Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultin CVE-2026-921378.8Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is co CVE-2026-921384.2The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the su CVE-2026-921396.5Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and CVE-2026-92144.5Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network CVE-2026-921406.8Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, result