CVE-2026-9210
Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router
CVE-2026-9210 is a medium vulnerability (CVSS 4.9) in Netgear Ex3700, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.
- Severity
- 4.9 MediumCVSS 4.0, CVE List
- Exploit chance
- 0.22%EPSS, 12th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
- netgear ex3700
- netgear ex3700 firmware
- netgear ex3800
- netgear ex3800 firmware
- netgear ex6120
- netgear ex6120 firmware
- netgear ex6130
- netgear ex6130 firmware
- netgear mr60
- netgear mr60 firmware
- netgear mr70
- netgear mr70 firmware
Show 50 moreShow less
- netgear mr80
- netgear mr80 firmware
- netgear ms60
- netgear ms60 firmware
- netgear ms70
- netgear ms70 firmware
- netgear ms80
- netgear ms80 firmware
- netgear r6400v2
- netgear r6400v2 firmware
- netgear r6700v3
- netgear r6700v3 firmware
- netgear r6900p
- netgear r6900p firmware
- netgear r7000
- netgear r7000 firmware
- netgear r7000p
- netgear r7000p firmware
- netgear r7960p
- netgear r7960p firmware
- netgear r8000p
- netgear r8000p firmware
- netgear r8500
- netgear r8500 firmware
- netgear rax20
- netgear rax20 firmware
- netgear rax35v2
- netgear rax35v2 firmware
- netgear rax40v2
- netgear rax40v2 firmware
- netgear rax41
- netgear rax41 firmware
- netgear rax42
- netgear rax42 firmware
- netgear rax43
- netgear rax43 firmware
- netgear rax45
- netgear rax45 firmware
- netgear rax48
- netgear rax48 firmware
- netgear rax50
- netgear rax50 firmware
- netgear rax50s
- netgear rax50s firmware
- netgear raxe450
- netgear raxe450 firmware
- netgear raxe500
- netgear raxe500 firmware
- netgear xr1000
- netgear xr1000 firmware
What each source reports
CVE List Score used
Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
- Record
CVE-2026-9210- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-35459
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
- Record
EUVD-2026-35459- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rgvr-gjhw-96v7
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated...
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
- Record
GHSA-rgvr-gjhw-96v7- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber - CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
- Record
CVE-2026-9210- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber - CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
netgear.com/support/product/ex3700
Show 28 moreShow less
kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
nvd.nist.gov/vuln/detail/CVE-2026-9210
github.com/advisories/GHSA-rgvr-gjhw-96v7