CVE-2026-9216: Insufficient input validation vulnerability exists in certain NETGEAR RAX Models
An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NETGEAR RAX30to a version that resolves this vulnerability.Fixed in V1.0.9.92 - Upgrade
Upgrade
NETGEAR RAX35to a version that resolves this vulnerability.Fixed in V1.0.10.72 - Upgrade
Upgrade
NETGEAR RAX38to a version that resolves this vulnerability.Fixed in V1.0.6.106 - Upgrade
Upgrade
NETGEAR RAX40to a version that resolves this vulnerability.Fixed in V1.0.6.106 - Upgrade
Upgrade
NETGEAR RAXE300to a version that resolves this vulnerability.Fixed in V1.0.9.82
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be network-adjacent and have network access to the router, such as WiFi credentials. The available information does not indicate that an unauthenticated internet-based attacker can exploit it.
What is the operational impact if exploitation succeeds?
Exploitation can crash the router's management UI. The vulnerability has no confidentiality or integrity impact, and the crash does not affect core router services such as the WiFi network.
Which products should be reviewed?
Review NETGEAR RAX series routers, particularly the RAX30, RAX35, and RAX38 models identified in the available product references.