Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by NETGEAR

CVE-2026-9212Insufficient authentication and input validation in certain NETGEAR products

Medium 5.6

In plain English

A medium-severity missing authentication in LBR1020 from NETGEAR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)5.6Medium
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Affected products (as reported)

VendorProductVersions
NETGEAR LBR1020 0 – before V2.6.4.60
NETGEAR LBR20 0 – before V2.7.6.8
NETGEAR R6700AX 0 – through *
NETGEAR R7800 0 – before V1.0.4.96
NETGEAR R9000 0 – before V1.0.6.46
NETGEAR RAX10 0 – before V1.0.5.50
NETGEAR RAX10v2 0 – before V1.0.5.50
NETGEAR RAX120 0 – before V1.2.10.56
NETGEAR RAX120v1 0 – before V1.2.10.56
NETGEAR RAX120v2 0 – before V1.2.10.56
NETGEAR RAX36S 0 – before V1.0.5.50
NETGEAR RAX70 0 – before V1.0.19.172
NETGEAR RAX78 0 – before V1.0.19.172
NETGEAR RBR10 0 – before 2.7.5.6
NETGEAR RBR20 0 – before 2.7.5.6
NETGEAR RBR350 0 – before V4.4.2.1
NETGEAR RBR40 0 – before 2.7.5.6
NETGEAR RBR50 0 – before 2.7.5.6
NETGEAR RBS10 0 – before 2.7.5.6
NETGEAR RBS20 0 – before 2.7.5.6
NETGEAR RBS350 0 – before V4.4.2.1
NETGEAR RBS40 0 – before 2.7.5.6
NETGEAR RBS50 0 – before 2.7.5.6
NETGEAR XR450 0 – before V2.3.3.136
NETGEAR XR500 0 – before v2.3.3.136

Weakness: CWE-306, CWE-20 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:U

References