Description
Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.
Published: 2026-06-09
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: ProductFixed VersionLBR1020 (EoS) Orbi 4GX AC1200 Dual-Band Mesh WiFi Router V2.6.4.60 https://www.netgear.com/support/product/lbr1020/ LBR20 Orbi LTE Tri-band WiFi Router V2.7.6.8 https://www.netgear.com/support/product/lbr20/ R6700AX (EoS) 4-Stream AX1800 WiFi 6 RouterEOSR7800 (EoS) Nighthawk X4S AC2600 Smart WiFi Router V1.0.4.96 https://www.netgear.com/support/product/r7800/ R9000 (EoS) Nighthawk X10 AD7200 Smart WiFi Router V1.0.6.46 https://www.netgear.com/support/product/r9000/ RAX10 4-Stream AX1800 WiFi 6 Router V1.0.5.50 https://www.netgear.com/support/product/rax10/ RAX10v2V1.0.5.50RAX120 (EoS) Nighthawk AX12 12-Stream WiFi Router V1.2.10.56 https://www.netgear.com/support/product/rax120/ RAX120v1 (EoS)V1.2.10.56RAX120v2 Nighthawk AX12 12-Stream AX6000 WiFi Router V1.2.10.56 https://www.netgear.com/support/product/rax120v2/ RAX36S Nighthawk AX4 4-Stream AX3000 WiFi Router V1.0.5.50 https://www.netgear.com/support/product/rax36s/ RAX70 Nighthawk Tri-band AX8 8-Stream AX6600 WiFi 6 Router V1.0.19.172 https://www.netgear.com/support/product/rax70/ RAX78 Nighthawk AX8 8-Stream AX6200 Tri-Band WiFi Router V1.0.19.172 https://www.netgear.com/support/product/rax78/ RBR10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi RouterEOSRBR20 (EoS) Orbi AC2200 Tri-band WiFi RouterEOSRBR350 Orbi AX1800 WiFi 6 Dual-band Mesh Router V4.4.2.1 https://www.netgear.com/support/product/rbr350/ RBR40 (EoS) Orbi AC2200 Tri-band WiFi RouterEOSRBR50 (EoS) Orbi AC3000 Tri-band WiFi RouterEOSRBS10 (EoS) Orbi AC1200 Dual-Band Mesh WiFi Add-on SatelliteEOSRBS20 (EoS) Orbi AC2200 Tri-band WiFi Add-on SatelliteEOSRBS350 Orbi AX1800 WiFi 6 Dual-band Mesh Add-on Satellite V4.4.2.1 https://www.netgear.com/support/product/rbs350/ RBS40 (EoS) Orbi AC2200 Tri-band WiFi Add-on SatelliteEOSRBS50 (EoS) Orbi AC3000 Tri-band WiFi Add-on SatelliteEOSXR450 (EoS) Nighthawk Pro Gaming Router V2.3.3.136 https://www.netgear.com/support/product/xr450/ XR500 (EoS) Nighthawk Pro Gaming Router v2.3.3.136 https://www.netgear.com/support/product/xr500/ Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 11 Jun 2026 05:15:00 +0000

Type Values Removed Values Added
Description Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting product's confidentiality or change certain configurations. Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Wed, 10 Jun 2026 16:00:00 +0000

Type Values Removed Values Added
References

Wed, 10 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 09 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Netgear
Netgear lbr1020
Netgear lbr20
Netgear r6700ax
Netgear r7800
Netgear r9000
Netgear rax10
Netgear rax10v2
Netgear rax120
Netgear rax120v1
Netgear rax120v2
Netgear rax36s
Netgear rax70
Netgear rax78
Netgear rbr10
Netgear rbr20
Netgear rbr350
Netgear rbr40
Netgear rbr50
Netgear rbs10
Netgear rbs20
Netgear rbs350
Netgear rbs40
Netgear rbs50
Netgear xr450
Netgear xr500
Vendors & Products Netgear
Netgear lbr1020
Netgear lbr20
Netgear r6700ax
Netgear r7800
Netgear r9000
Netgear rax10
Netgear rax10v2
Netgear rax120
Netgear rax120v1
Netgear rax120v2
Netgear rax36s
Netgear rax70
Netgear rax78
Netgear rbr10
Netgear rbr20
Netgear rbr350
Netgear rbr40
Netgear rbr50
Netgear rbs10
Netgear rbs20
Netgear rbs350
Netgear rbs40
Netgear rbs50
Netgear xr450
Netgear xr500

Tue, 09 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 09 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Description Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting product's confidentiality or change certain configurations.
Title Insufficient authentication and input validation in certain NETGEAR products
Weaknesses CWE-20
CWE-306
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:U'}


Subscriptions

Netgear Lbr1020 Lbr1020 Firmware Lbr20 Lbr20 Firmware R6700ax R6700ax Firmware R7800 R7800 Firmware R9000 R9000 Firmware Rax10 Rax10 Firmware Rax10v2 Rax120 Rax120 Firmware Rax120v1 Rax120v2 Rax36s Rax36s Firmware Rax70 Rax70 Firmware Rax78 Rax78 Firmware Rbr10 Rbr10 Firmware Rbr20 Rbr20 Firmware Rbr350 Rbr350 Firmware Rbr40 Rbr40 Firmware Rbr50 Rbr50 Firmware Rbs10 Rbs10 Firmware Rbs20 Rbs20 Firmware Rbs350 Rbs350 Firmware Rbs40 Rbs40 Firmware Rbs50 Rbs50 Firmware Xr450 Xr450 Firmware Xr500 Xr500 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: NETGEAR

Published:

Updated: 2026-06-11T05:03:05.236Z

Reserved: 2026-05-21T17:29:04.787Z

Link: CVE-2026-9212

cve-icon Vulnrichment

Updated: 2026-06-09T17:14:10.889Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T17:17:51.517

Modified: 2026-07-23T08:10:00.137

Link: CVE-2026-9212

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-11T07:00:09Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-306

    Missing Authentication for Critical Function