3.5Low
CVE-2026-9216Insufficient input validation vulnerability exists in certain NETGEAR RAX Models
Description
An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.
Weakness (CWE):
CWE-121
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| NETGEAR | RAX30 | < V1.0.9.92 | |
| netgear | rax30 firmware | < 1.0.9.92 | |
| NETGEAR | RAX35 | < V1.0.10.72 | |
| netgear | rax35 firmware | < 1.0.10.72 | |
| NETGEAR | RAX38 | < V1.0.6.106 | |
| netgear | rax38 firmware | < 1.0.6.106 | |
| NETGEAR | RAX40 | < V1.0.6.106 | |
| netgear | rax40 firmware | < 1.0.6.106 | |
| NETGEAR | RAXE300 | < V1.0.9.82 | |
| netgear | raxe300 firmware | < 1.0.10.72 |
References and patches
- https://www.netgear.com/support/product/rax30 productpatchProduct
- https://www.netgear.com/support/product/rax35 productpatchProduct
- https://www.netgear.com/support/product/rax38 productpatchProduct
- https://www.netgear.com/support/product/rax40 productpatchProduct
- https://www.netgear.com/support/product/raxe300 productpatchProduct
- https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory vendor-advisorypatchVendor Advisory
CPE matches (NVD) (5)
cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*< 1.0.9.92cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:*< 1.0.10.72cpe:2.3:o:netgear:rax38_firmware:*:*:*:*:*:*:*:*< 1.0.6.106cpe:2.3:o:netgear:rax40_firmware:*:*:*:*:*:*:*:*< 1.0.6.106cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*< 1.0.10.72