Read the docs
TI-2026-71753 Aliases CVE-2026-9218GHSA-gxq5-cgpc-wcvr

Improper input validation in NETGEAR router time server settings

Priority LOW 19CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Insufficient input validation in the time server (NTP) setting of several NETGEAR routers, including CBR40, R7000, R7000P and RAX40, lets an attacker on the local network who holds the router's administrator credentials run unauthorized commands on the router. The flaw, classified as CWE-20, can impact the integrity of the affected router, with no impact on confidentiality or availability. The flaw is not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00185 8th percentileScored 2026-11-07
Fix Fixed R7000 (NETGEAR): v1.0.11.130R7000P (NETGEAR): V1.3.3.152+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARCBR40all versions—No fix listedCNA
NETGEARR7000before v1.0.11.130v1.0.11.130Patch availableCNA
NETGEARR7000Pbefore V1.3.3.152V1.3.3.152Patch availableCNA
NETGEARRAX40before V1.0.3.64V1.0.3.64Patch availableCNA
  • CBR40 VendorNETGEAR Affected all versions Fixed in — No fix listed CNA
  • R7000 VendorNETGEAR Affected before v1.0.11.130 Fixed in v1.0.11.130 Patch available CNA
  • R7000P VendorNETGEAR Affected before V1.3.3.152 Fixed in V1.3.3.152 Patch available CNA
  • RAX40 VendorNETGEAR Affected before V1.0.3.64 Fixed in V1.0.3.64 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:*——NETGEAR
  • cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:* Versions — — ·NETGEAR

Remediation

Update R7000 to v1.0.11.130, R7000P to V1.3.3.152 and RAX40 to V1.0.3.64. The sources list no fixed version for CBR40.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA R7000 (NETGEAR) Fixed in v1.0.11.130
  • Fix · CNA R7000P (NETGEAR) Fixed in V1.3.3.152
  • Fix · CNA RAX40 (NETGEAR) Fixed in V1.0.3.64

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-9218
  2. 2026-10-13 Alias added: GHSA-gxq5-cgpc-wcvr
  3. 2026-10-13 CVSS score changed · CNA
  4. 2026-10-16 1 new reference · CNA
  5. 2026-10-16 CISA SSVC decision points changed

References

Patch 5

  • TI-2020-16346 NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-04600 Buffer overflow in NETGEAR All versions prior to WNR2000v3 1.1.2.14, WNR2000v4 1.0.0.66… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03982 ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-08250 The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-01416 (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-04162 dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1HIGH 8.8
See all 1364 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences