CVE-2026-9210: Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router

Description

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack vector

Adjacent

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 12% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EX

EX3700 · NETGEAR

before V1.0.0.100 · source: vendor

EX

EX3800 · NETGEAR

before V1.0.0.100 · source: vendor

EX

EX6120 · NETGEAR

before V1.0.0.72 · source: vendor

EX

EX6130 · NETGEAR

before V1.0.0.54 · source: vendor

MR

MR60 · NETGEAR

before V1.1.7.132 · source: vendor

MR

MR70 · NETGEAR

before V1.0.3.28 · source: vendor

MR

MR80 · NETGEAR

before V1.1.7.14 · source: vendor

MS

MS60 · NETGEAR

before V1.1.7.132 · source: vendor

MS

MS70 · NETGEAR

before V1.0.3.28 · source: vendor

MS

MS80 · NETGEAR

before V1.1.7.14 · source: vendor

R6

R6400v2 · NETGEAR

before V1.0.4.128 · source: vendor

R6

R6700v3 · NETGEAR

before V1.0.4.128 · source: vendor