6.7Media
CVE-2026-9215A CSRF vulnerability exists in certain NETGEAR XR series devices
Descripción
A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.
Debilidad (CWE):
CWE-352
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| netgear | xr1000 firmware | < 1.1.0.22 | |
| NETGEAR | XR1000v2 | < V1.1.0.22 | |
| netgear | xr1000v2 firmware | < 1.1.0.22 | |
| NETGEAR | XR500 | < v2.3.5.152 | |
| netgear | xr500 firmware | < 2.3.5.152 |
Referencias y parches
- https://www.netgear.com/support/product/xr500 productpatchProduct
- https://www.netgear.com/support/product/xr1000 productpatchProduct
- https://www.netgear.com/support/product/xr1000v2 productpatchProduct
- https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory vendor-advisorypatchVendor Advisory
Coincidencias CPE (NVD) (3)
cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*< 1.1.0.22cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*< 1.1.0.22cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*< 2.3.5.152