CVE-2026-9213: Insufficient input validation in certain NETGEAR routers

High severity · published Jun 9, 2026

CVE-2026-9213

Insufficient input validation in certain NETGEAR routers

8.1

CVSS

0.4%

EPSS

On KEV

Description

A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 34% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MR70 · NETGEAR

before V1.0.4.48 · source: vendor

MS70 · NETGEAR

before V1.0.4.48 · source: vendor

RAXE500 · NETGEAR

before V1.2.14.114 · source: vendor

XR1000 · NETGEAR

before V1.0.2.86 · source: vendor

Mr70 Firmware · Netgear

before 1.0.4.48 · source: NVD

Ms70 Firmware · Netgear

before 1.0.4.48 · source: NVD

Raxe500 Firmware · Netgear

before 1.2.14.114 · source: NVD

Xr1000 Firmware · Netgear

before 1.0.2.86 · source: NVD

Affected product

MR70

NETGEAR

All MR70 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-9213

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-9213

Vendor Advisory

https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory

Product

https://www.netgear.com/support/product/mr70/

Product

https://www.netgear.com/support/product/ms70/

Product

https://www.netgear.com/support/product/raxe500/

Product

https://www.netgear.com/support/product/xr1000/