Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-9212

high

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the prod…

Vendor / product: Netgear — lbr1020 firmware

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

CVSS
8.0
8.0 (CVSS v3.1)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-06-09 17:17
Modified: 2026-11-04 18:17
NVD status: Analyzed
Last synced 7 hours ago
Verified against the source API 2026-11-04 18:35 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

netgear / lbr1020_firmware <2.6.4.60
netgear / lbr20_firmware <2.7.6.8
netgear / r6700ax_firmware all versions
netgear / r7800_firmware <1.0.4.96
netgear / r9000_firmware <1.0.6.46
netgear / rax10_firmware <1.0.5.50
netgear / rax120_firmware <1.2.10.56
netgear / rax36s_firmware <1.0.5.50
netgear / rax70_firmware <1.0.19.172
netgear / rax78_firmware <1.0.19.172
netgear / rbr10_firmware all versions
netgear / rbr20_firmware all versions
netgear / rbr350_firmware <4.4.2.1
netgear / rbr40_firmware all versions
netgear / rbr50_firmware all versions
netgear / rbs10_firmware all versions
netgear / rbs20_firmware all versions
netgear / rbs350_firmware <4.4.2.1
netgear / rbs40_firmware all versions
netgear / rbs50_firmware all versions
netgear / xr450_firmware <2.3.3.136
netgear / xr500_firmware <2.3.3.136

Weakness classification (CWE)

CWE-20 CWE-306

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
Patch / mitigation: https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory

References

Data sources

NVD CVE API 2.0 — fetched 2026-11-04 18:35 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-9216CVE-2026-9215