Medium severity · published Aug 11, 2026
CVE-2026-9214
Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device.
4.5
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient input validation vulnerability in the NETGEAR R7000 models
allows authenticated administrators connected to the local network to
make unauthorized modification to router software and functionality.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R7
R7000 · NETGEAR
V1.0.12.216 · source: vendor
RF
R7000 Firmware · Netgear
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9214
Vendor Advisory
https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory
Product
https://www.netgear.com/support/product/r7000
More from R7000
4.9
CVE-2026-11735
Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models
4.5
CVE-2026-9218
Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access
4.5
CVE-2026-0417
Insufficient input validation in certain NETGEAR routers
4.5
CVE-2026-9210
Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router
4.5
CVE-2026-0410
Insufficient input validation in certain NETGEAR routers