CVE-2026-9215

A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory	Vendor Advisory
https://www.netgear.com/support/product/xr1000	Product
https://www.netgear.com/support/product/xr1000v2	Product
https://www.netgear.com/support/product/xr500	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:xr1000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:xr1000v2:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:xr500:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-09-08 18:21

Updated : 2026-09-11 21:20

NVD link : CVE-2026-9215

Mitre link : CVE-2026-9215

CVE.ORG link : CVE-2026-9215

JSON object : View

Products Affected

netgear

xr500
xr1000_firmware
xr500_firmware
xr1000v2
xr1000
xr1000v2_firmware

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-9215", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9215", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T18:26:12.430605Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.5}], "cvssMetricV40": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.8, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "affectedData": [{"vendor": "NETGEAR", "product": "XR1000", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.0.22", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "XR1000v2", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.0.22", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "NETGEAR", "product": "XR500", "versions": [{"status": "affected", "version": "0", "lessThan": "v2.3.5.152", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T18:21:17.893", "references": [{"url": "https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory", "tags": ["Vendor Advisory"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/xr1000", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/xr1000v2", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/xr500", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows\u00a0an\u00a0attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability."}], "lastModified": "2026-09-11T21:20:24.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80874BD7-33C7-481D-8A97-9A4B5E0144A5", "versionEndExcluding": "1.1.0.22"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:xr1000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4FD4ED11-4130-47DA-8A9D-55B8F6E3E213"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79C9605E-5D93-4C78-A935-9894ED02CE22", "versionEndExcluding": "1.1.0.22"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:xr1000v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "697B2136-87A6-4E8F-8B5E-373B02E9D6D7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB08953B-4943-4DCF-98FF-810C3F4F7465", "versionEndExcluding": "2.3.5.152"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:xr500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9E203D92-F97B-4F5B-B395-3A5DEDBF1C1C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5"}