CVE-2026-9218: Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access

Published Oct 13, 2026

Updated

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.

Affected Software

1 affected component

Netgear NETGEAR routers

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NETGEAR R7000 to a version that resolves this vulnerability.
Fixed in v1.0.11.130
Upgrade
Upgrade NETGEAR R7000P to a version that resolves this vulnerability.
Fixed in V1.3.3.152
Upgrade
Upgrade NETGEAR RAX40 to a version that resolves this vulnerability.
Fixed in V1.0.3.64

Event History

Oct 13, 2026

CVE Published

via MITRE·02:34 PM

Data Sourced

via MITRE·02:34 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Can this be exploited remotely over the internet without access to the local network?

The attacker must be connected to the router’s local network and possess the router administrator credentials. The provided information does not describe exploitation by an unauthenticated internet-based attacker.

What is the expected security impact if exploitation succeeds?

An attacker can run unauthorized commands on the router, affecting its integrity. The provided information states that confidentiality and availability are not impacted.