Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by NETGEAR

CVE-2026-9218Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access

Medium 4.5

In plain English

A medium-severity improper input validation in CBR40 from NETGEAR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.5Medium
Exploit odds (30 days)0.2%top 91.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.

Affected products (as reported)

VendorProductVersions
NETGEAR CBR40 0 – before *
NETGEAR R7000 0 – before v1.0.11.130
NETGEAR R7000P 0 – before V1.3.3.152
NETGEAR RAX40 0 – before V1.0.3.64

Weakness: CWE-20 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References