6.7Medium
CVE-2026-9215A CSRF vulnerability exists in certain NETGEAR XR series devices
Description
A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.
Weakness (CWE):
CWE-352
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| netgear | xr1000 firmware | < 1.1.0.22 | |
| NETGEAR | XR1000v2 | < V1.1.0.22 | |
| netgear | xr1000v2 firmware | < 1.1.0.22 | |
| NETGEAR | XR500 | < v2.3.5.152 | |
| netgear | xr500 firmware | < 2.3.5.152 |
References and patches
- https://www.netgear.com/support/product/xr500 productpatchProduct
- https://www.netgear.com/support/product/xr1000 productpatchProduct
- https://www.netgear.com/support/product/xr1000v2 productpatchProduct
- https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory vendor-advisorypatchVendor Advisory
CPE matches (NVD) (3)
cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*< 1.1.0.22cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*< 1.1.0.22cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*< 2.3.5.152