Read the docs
TI-2026-08101 Aliases CVE-2026-9216GHSA-j39v-qjh2-5wqg

Insufficient input validation vulnerability exists in certain NETGEAR RAX Models

Priority LOW 8CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0036 29th percentileScored 2026-11-07
Fix Fixed RAX30 (NETGEAR): V1.0.9.92RAX35 (NETGEAR): V1.0.10.72+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARRAX30before V1.0.9.92V1.0.9.92Patch availableCNA
NETGEARRAX35before V1.0.10.72V1.0.10.72Patch availableCNA
NETGEARRAX38before V1.0.6.106V1.0.6.106Patch availableCNA
NETGEARRAX40before V1.0.6.106V1.0.6.106Patch availableCNA
NETGEARRAXE300before V1.0.9.82V1.0.9.82Patch availableCNA
  • RAX30 VendorNETGEAR Affected before V1.0.9.92 Fixed in V1.0.9.92 Patch available CNA
  • RAX35 VendorNETGEAR Affected before V1.0.10.72 Fixed in V1.0.10.72 Patch available CNA
  • RAX38 VendorNETGEAR Affected before V1.0.6.106 Fixed in V1.0.6.106 Patch available CNA
  • RAX40 VendorNETGEAR Affected before V1.0.6.106 Fixed in V1.0.6.106 Patch available CNA
  • RAXE300 VendorNETGEAR Affected before V1.0.9.82 Fixed in V1.0.9.82 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*before 1.0.9.92VulnerableNETGEAR
cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:*before 1.0.10.72VulnerableNETGEAR
cpe:2.3:h:netgear:rax35:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax38_firmware:*:*:*:*:*:*:*:*before 1.0.6.106VulnerableNETGEAR
cpe:2.3:h:netgear:rax38:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax40_firmware:*:*:*:*:*:*:*:*before 1.0.6.106VulnerableNETGEAR
cpe:2.3:h:netgear:rax40:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*before 1.0.10.72VulnerableNETGEAR
cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:* Versions before 1.0.9.92 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:* Versions before 1.0.10.72 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax38_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.106 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax38:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax40_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.106 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:* Versions before 1.0.10.72 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

  • Fix · CNA RAX30 (NETGEAR) Fixed in V1.0.9.92
  • Fix · CNA RAX35 (NETGEAR) Fixed in V1.0.10.72
  • Fix · CNA RAX38 (NETGEAR) Fixed in V1.0.6.106
  • Fix · CNA RAX40 (NETGEAR) Fixed in V1.0.6.106
  • Fix · CNA RAXE300 (NETGEAR) Fixed in V1.0.9.82

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9216
  2. 2026-10-03 Alias added: GHSA-j39v-qjh2-5wqg
  3. 2026-10-13 Fix available: NETGEAR/[email protected] · CNA

References

Patch 6

  • TI-2023-26560 Stack-based buffer overflow in NETGEAR RAX30 CVSS 3.1HIGH 8.8
  • TI-2022-23402 Improper authentication in NETGEAR Nighthawk WiFi6 Router CVSS 3.1HIGH 8.8
  • TI-2023-12452 Buffer overflow in NETGEAR Nighthawk WiFi6 Router CVSS 3.1CRITICAL 9.8
  • TI-2025-28644 In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not… CVSS 3.1CRITICAL 9.8
  • TI-2023-12451 Buffer overflow in NETGEAR Nighthawk WiFi6 Router CVSS 3.1CRITICAL 9.8
  • TI-2023-01254 Improper authentication in Netgear RAX30 CVSS 3.1CRITICAL 9.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences