CVE-2026-9218 Details
Description
Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory | Netgear, Inc. | |
| https://www.netgear.com/support/product/cbr40/ | Netgear, Inc. | |
| https://www.netgear.com/support/product/r7000/ | Netgear, Inc. | |
| https://www.netgear.com/support/product/r7000p/ | Netgear, Inc. | |
| https://www.netgear.com/support/product/rax40/ | Netgear, Inc. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | Netgear, Inc. |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | Netgear, Inc. |
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | CVE Modified | Netgear, Inc. |
| Oct 13, 2026 | New CVE Received | Netgear, Inc. |