Log in Start free

Vulnerability · Published Sep 8, 2026 · Assigned by NETGEAR

CVE-2026-9216Insufficient input validation vulnerability exists in certain NETGEAR RAX Models

Low 3.5

In plain English

A low-severity stack buffer overflow in RAX30 from NETGEAR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.4%top 70.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.

Affected products (as reported)

VendorProductVersions
NETGEAR RAX30 0 – before V1.0.9.92
NETGEAR RAX35 0 – before V1.0.10.72
NETGEAR RAX38 0 – before V1.0.6.106
NETGEAR RAX40 0 – before V1.0.6.106
NETGEAR RAXE300 0 – before V1.0.9.82

Weakness: CWE-121 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References