6.7Mittel
CVE-2026-9215A CSRF vulnerability exists in certain NETGEAR XR series devices
Beschreibung
A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.
Schwachstellentyp (CWE):
CWE-352
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| netgear | xr1000 firmware | < 1.1.0.22 | |
| NETGEAR | XR1000v2 | < V1.1.0.22 | |
| netgear | xr1000v2 firmware | < 1.1.0.22 | |
| NETGEAR | XR500 | < v2.3.5.152 | |
| netgear | xr500 firmware | < 2.3.5.152 |
Referenzen und Patches
- https://www.netgear.com/support/product/xr500 productpatchProduct
- https://www.netgear.com/support/product/xr1000 productpatchProduct
- https://www.netgear.com/support/product/xr1000v2 productpatchProduct
- https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory vendor-advisorypatchVendor Advisory
CPE-Treffer (NVD) (3)
cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*< 1.1.0.22cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*< 1.1.0.22cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*< 2.3.5.152