CVE-2026-9215

A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.

Score

CVSS 3.1 6.7 Medium

Status

Analyzed - a2826606-91e7-4eb6-899e-8484bd4575d5

Published

2026-09-08

Last modified

2026-10-13

Weaknesses

CWE-352

Affected products

• Xr1000 Firmware (Netgear)
• Xr1000v2 (Netgear)
• Xr1000v2 Firmware (Netgear)
• Xr500 (Netgear)
• Xr500 Firmware (Netgear)

References

• https://www.netgear.com/support/product/xr500
• https://www.netgear.com/support/product/xr1000
• https://www.netgear.com/support/product/xr1000v2
• https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory