Read the docs
TI-2026-08096 Aliases CVE-2026-9211GHSA-grpw-fvf6-9688

Certain NETGEAR routers allow unauthenticated users to gain control of the router

Priority LOW 25CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed CAX30 (NETGEAR): V2.2.1.4RAX30 (NETGEAR): V1.0.10.94+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARCAX30before V2.2.1.4V2.2.1.4Patch availableCNA
NETGEARRAX30before V1.0.10.94V1.0.10.94Patch availableCNA
NETGEARRAX5before V1.0.5.34V1.0.5.34Patch availableCNA
NETGEARRAXE300before V1.0.10.72V1.0.10.72Patch availableCNA
  • CAX30 VendorNETGEAR Affected before V2.2.1.4 Fixed in V2.2.1.4 Patch available CNA
  • RAX30 VendorNETGEAR Affected before V1.0.10.94 Fixed in V1.0.10.94 Patch available CNA
  • RAX5 VendorNETGEAR Affected before V1.0.5.34 Fixed in V1.0.5.34 Patch available CNA
  • RAXE300 VendorNETGEAR Affected before V1.0.10.72 Fixed in V1.0.10.72 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:netgear:cax30_firmware:*:*:*:*:*:*:*:*before 2.2.1.4VulnerableNETGEAR
cpe:2.3:h:netgear:cax30:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*before 1.0.10.94VulnerableNETGEAR
cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax5_firmware:*:*:*:*:*:*:*:*before 1.0.5.34VulnerableNETGEAR
cpe:2.3:h:netgear:rax5:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*before 1.0.10.72VulnerableNETGEAR
cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:cax30_firmware:*:*:*:*:*:*:*:* Versions before 2.2.1.4 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:cax30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:* Versions before 1.0.10.94 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax5_firmware:*:*:*:*:*:*:*:* Versions before 1.0.5.34 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:* Versions before 1.0.10.72 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

  • Fix · CNA CAX30 (NETGEAR) Fixed in V2.2.1.4
  • Fix · CNA RAX30 (NETGEAR) Fixed in V1.0.10.94
  • Fix · CNA RAX5 (NETGEAR) Fixed in V1.0.5.34
  • Fix · CNA RAXE300 (NETGEAR) Fixed in V1.0.10.72

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9211
  2. 2026-10-03 Alias added: GHSA-grpw-fvf6-9688

References

Patch 4

Advisory 1

  • TI-2022-21422 OS command injection in NETGEAR CAX30S CVSS 3.0HIGH 8.8
  • TI-2023-23951 Stack-based buffer overflow in NETGEAR CAX30 CVSS 3.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences