Read the docs
TI-2026-08097 Aliases CVE-2026-9212GHSA-wq28-w638-7xcv

Insufficient authentication and input validation in certain NETGEAR products

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed LBR1020 (NETGEAR): V2.6.4.60LBR20 (NETGEAR): V2.7.6.8+14 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARLBR1020before V2.6.4.60V2.6.4.60Patch availableCNA
NETGEARLBR20before V2.7.6.8V2.7.6.8Patch availableCNA
NETGEARR6700AXall versions—No fix listedCNA
NETGEARR7800before V1.0.4.96V1.0.4.96Patch availableCNA
NETGEARR9000before V1.0.6.46V1.0.6.46Patch availableCNA
NETGEARRAX10before V1.0.5.50V1.0.5.50Patch availableCNA
NETGEARRAX10v2before V1.0.5.50V1.0.5.50Patch availableCNA
NETGEARRAX120before V1.2.10.56V1.2.10.56Patch availableCNA
NETGEARRAX120v1before V1.2.10.56V1.2.10.56Patch availableCNA
NETGEARRAX120v2before V1.2.10.56V1.2.10.56Patch availableCNA
NETGEARRAX36Sbefore V1.0.5.50V1.0.5.50Patch availableCNA
NETGEARRAX70before V1.0.19.172V1.0.19.172Patch availableCNA
NETGEARRAX78before V1.0.19.172V1.0.19.172Patch availableCNA
NETGEARRBR10up to 2.7.6.6—No fix listedCNA
NETGEARRBR20up to 2.7.6.6—No fix listedCNA
NETGEARRBR350before V4.4.2.1V4.4.2.1Patch availableCNA
NETGEARRBR40up to 2.7.6.6—No fix listedCNA
NETGEARRBR50up to 2.7.6.6—No fix listedCNA
NETGEARRBS10up to 2.7.6.6—No fix listedCNA
NETGEARRBS20up to 2.7.6.6—No fix listedCNA
NETGEARRBS350before V4.4.2.1V4.4.2.1Patch availableCNA
NETGEARRBS40up to 2.7.6.6—No fix listedCNA
NETGEARRBS50up to 2.7.6.6—No fix listedCNA
NETGEARXR450before V2.3.3.136V2.3.3.136Patch availableCNA
NETGEARXR500before v2.3.3.136v2.3.3.136Patch availableCNA
  • LBR1020 VendorNETGEAR Affected before V2.6.4.60 Fixed in V2.6.4.60 Patch available CNA
  • LBR20 VendorNETGEAR Affected before V2.7.6.8 Fixed in V2.7.6.8 Patch available CNA
  • R6700AX VendorNETGEAR Affected all versions Fixed in — No fix listed CNA
  • R7800 VendorNETGEAR Affected before V1.0.4.96 Fixed in V1.0.4.96 Patch available CNA
  • R9000 VendorNETGEAR Affected before V1.0.6.46 Fixed in V1.0.6.46 Patch available CNA
  • RAX10 VendorNETGEAR Affected before V1.0.5.50 Fixed in V1.0.5.50 Patch available CNA
  • RAX10v2 VendorNETGEAR Affected before V1.0.5.50 Fixed in V1.0.5.50 Patch available CNA
  • RAX120 VendorNETGEAR Affected before V1.2.10.56 Fixed in V1.2.10.56 Patch available CNA
  • RAX120v1 VendorNETGEAR Affected before V1.2.10.56 Fixed in V1.2.10.56 Patch available CNA
  • RAX120v2 VendorNETGEAR Affected before V1.2.10.56 Fixed in V1.2.10.56 Patch available CNA
  • RAX36S VendorNETGEAR Affected before V1.0.5.50 Fixed in V1.0.5.50 Patch available CNA
  • RAX70 VendorNETGEAR Affected before V1.0.19.172 Fixed in V1.0.19.172 Patch available CNA
  • RAX78 VendorNETGEAR Affected before V1.0.19.172 Fixed in V1.0.19.172 Patch available CNA
  • RBR10 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • RBR20 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • RBR350 VendorNETGEAR Affected before V4.4.2.1 Fixed in V4.4.2.1 Patch available CNA
  • RBR40 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • RBR50 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • RBS10 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • RBS20 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • RBS350 VendorNETGEAR Affected before V4.4.2.1 Fixed in V4.4.2.1 Patch available CNA
  • RBS40 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • RBS50 VendorNETGEAR Affected up to 2.7.6.6 Fixed in — No fix listed CNA
  • XR450 VendorNETGEAR Affected before V2.3.3.136 Fixed in V2.3.3.136 Patch available CNA
  • XR500 VendorNETGEAR Affected before v2.3.3.136 Fixed in v2.3.3.136 Patch available CNA

CPE configurations NVD · 46

CPEVersionsRoleVendor
cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:*before 2.6.4.60VulnerableNETGEAR
cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:*before 2.7.6.8VulnerableNETGEAR
cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r6700ax_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:r6700ax:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:*before 1.0.4.96VulnerableNETGEAR
cpe:2.3:h:netgear:r7800:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:*before 1.0.6.46VulnerableNETGEAR
cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:* Versions before 2.6.4.60 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:* Versions before 2.7.6.8 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r6700ax_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r6700ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:* Versions before 1.0.4.96 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r7800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.46 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
Show 36 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:netgear:rax10_firmware:*:*:*:*:*:*:*:*before 1.0.5.50VulnerableNETGEAR
cpe:2.3:h:netgear:rax10:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax120_firmware:*:*:*:*:*:*:*:*before 1.2.10.56VulnerableNETGEAR
cpe:2.3:h:netgear:rax120:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:h:netgear:rax120:1.0:*:*:*:*:*:*:*1.0Running onNETGEAR
cpe:2.3:h:netgear:rax120:2.0:*:*:*:*:*:*:*2.0Running onNETGEAR
cpe:2.3:o:netgear:rax36s_firmware:*:*:*:*:*:*:*:*before 1.0.5.50VulnerableNETGEAR
cpe:2.3:h:netgear:rax36s:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax70_firmware:*:*:*:*:*:*:*:*before 1.0.19.172VulnerableNETGEAR
cpe:2.3:h:netgear:rax70:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax78_firmware:*:*:*:*:*:*:*:*before 1.0.19.172VulnerableNETGEAR
cpe:2.3:h:netgear:rax78:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr10_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbr10:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr20_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbr20:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr350_firmware:*:*:*:*:*:*:*:*before 4.4.2.1VulnerableNETGEAR
cpe:2.3:h:netgear:rbr350:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr40_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbr40:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr50_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbr50:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs10_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbs10:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs20_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbs20:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs350_firmware:*:*:*:*:*:*:*:*before 4.4.2.1VulnerableNETGEAR
cpe:2.3:h:netgear:rbs350:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs40_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbs40:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs50_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNETGEAR
cpe:2.3:h:netgear:rbs50:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:xr450_firmware:*:*:*:*:*:*:*:*before 2.3.3.136VulnerableNETGEAR
cpe:2.3:h:netgear:xr450:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*before 2.3.3.136VulnerableNETGEAR
cpe:2.3:h:netgear:xr500:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:rax10_firmware:*:*:*:*:*:*:*:* Versions before 1.0.5.50 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax120_firmware:*:*:*:*:*:*:*:* Versions before 1.2.10.56 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:h:netgear:rax120:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·NETGEAR
  • cpe:2.3:h:netgear:rax120:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax36s_firmware:*:*:*:*:*:*:*:* Versions before 1.0.5.50 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax36s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax70_firmware:*:*:*:*:*:*:*:* Versions before 1.0.19.172 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax78_firmware:*:*:*:*:*:*:*:* Versions before 1.0.19.172 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax78:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr10_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr20_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr350_firmware:*:*:*:*:*:*:*:* Versions before 4.4.2.1 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr40_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr50_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs10_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs20_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs350_firmware:*:*:*:*:*:*:*:* Versions before 4.4.2.1 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs40_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs50_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:xr450_firmware:*:*:*:*:*:*:*:* Versions before 2.3.3.136 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:xr450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:* Versions before 2.3.3.136 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:xr500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

  • Fix · CNA LBR1020 (NETGEAR) Fixed in V2.6.4.60
  • Fix · CNA LBR20 (NETGEAR) Fixed in V2.7.6.8
  • Fix · CNA R7800 (NETGEAR) Fixed in V1.0.4.96
  • Fix · CNA R9000 (NETGEAR) Fixed in V1.0.6.46
  • Fix · CNA RAX10 (NETGEAR) Fixed in V1.0.5.50
  • Fix · CNA RAX10v2 (NETGEAR) Fixed in V1.0.5.50
  • Fix · CNA RAX120 (NETGEAR) Fixed in V1.2.10.56
  • Fix · CNA RAX120v1 (NETGEAR) Fixed in V1.2.10.56
  • Fix · CNA RAX120v2 (NETGEAR) Fixed in V1.2.10.56
  • Fix · CNA RAX36S (NETGEAR) Fixed in V1.0.5.50
  • Fix · CNA RAX70 (NETGEAR) Fixed in V1.0.19.172
  • Fix · CNA RAX78 (NETGEAR) Fixed in V1.0.19.172
  • Fix · CNA RBR350 (NETGEAR) Fixed in V4.4.2.1
  • Fix · CNA RBS350 (NETGEAR) Fixed in V4.4.2.1
  • Fix · CNA XR450 (NETGEAR) Fixed in V2.3.3.136
  • Fix · CNA XR500 (NETGEAR) Fixed in v2.3.3.136

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    NETGEAR RAX120v1, RAX120v2 and 2 more products — kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-00273 A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi SatellitesPriority LOW 21
    • TI-2026-00282 Missing TLS certificate validation in NETGEAR's ReadyCloud client appPriority LOW 20
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9212
  2. 2026-10-03 Alias added: GHSA-wq28-w638-7xcv

References

Patch 24

  • TI-2021-20706 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
  • TI-2022-10627 Stack-based buffer overflow in NETGEAR R6700v3 CVSS 3.1HIGH 8.8
  • TI-2021-13937 Out-of-bounds write in NETGEAR R7800 CVSS 3.0HIGH 8.8
  • TI-2022-10625 Improper certificate validation in NETGEAR R6700v3 CVSS 3.1HIGH 8.8
  • TI-2021-20689 Certain NETGEAR devices are affected by command injection by an authenticated user. CVSS 3.1HIGH 7.8
  • TI-2021-20735 Certain NETGEAR devices are affected by disclosure of sensitive information. CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences