Riskcovery

CVE-2026-9212

Insufficient authentication and input validation in certain NETGEAR products

State
Published
Severity
5.6 Medium
Published
Jun 9, 2026
Updated
Jun 11, 2026
Reserved
May 21, 2026

Read the record on cve.org

Description

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Scores

CVSSScoreVectorSource
4.05.6 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:UNETGEAR

Weaknesses

  • CWE-306 Missing authentication for critical function
  • CWE-20 Improper input validation

Affected Products

ProductVersions
LBR1020NETGEAR
  • before V2.6.4.60Affected
LBR20NETGEAR
  • before V2.7.6.8Affected
R6700AXNETGEAR
  • all versionsAffected
R7800NETGEAR
  • before V1.0.4.96Affected
R9000NETGEAR
  • before V1.0.6.46Affected
RAX10NETGEAR
  • before V1.0.5.50Affected
RAX10v2NETGEAR
  • before V1.0.5.50Affected
RAX120NETGEAR
  • before V1.2.10.56Affected
RAX120v1NETGEAR
  • before V1.2.10.56Affected
RAX120v2NETGEAR
  • before V1.2.10.56Affected
RAX36SNETGEAR
  • before V1.0.5.50Affected
RAX70NETGEAR
  • before V1.0.19.172Affected
RAX78NETGEAR
  • before V1.0.19.172Affected
RBR10NETGEAR
  • 2.7.6.6 and earlierAffected
RBR20NETGEAR
  • 2.7.6.6 and earlierAffected
RBR350NETGEAR
  • before V4.4.2.1Affected
RBR40NETGEAR
  • 2.7.6.6 and earlierAffected
RBR50NETGEAR
  • 2.7.6.6 and earlierAffected
RBS10NETGEAR
  • 2.7.6.6 and earlierAffected
RBS20NETGEAR
  • 2.7.6.6 and earlierAffected
RBS350NETGEAR
  • before V4.4.2.1Affected
RBS40NETGEAR
  • 2.7.6.6 and earlierAffected
RBS50NETGEAR
  • 2.7.6.6 and earlierAffected
XR450NETGEAR
  • before V2.3.3.136Affected
XR500NETGEAR
  • before v2.3.3.136Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.