CVE-2026-9216Insufficient input validation vulnerability exists in certain NETGEAR RAX Models
Updated under an hour ago ()
Does this affect you?
It affects NETGEAR RAX30 and 9 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.
- CVSS
- 3.5 LOW (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Weakness (CWE)
- CWE-121
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- NETGEAR
- NVD analysis
- Analyzed
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
NETGEAR RAX30 netgear:rax30 (from the name) | before V1.0.9.92 | CNA record |
NETGEAR RAX35 netgear:rax35 (from the name) | before V1.0.10.72 | CNA record |
NETGEAR RAX38 netgear:rax38 (from the name) | before V1.0.6.106 | CNA record |
NETGEAR RAX40 netgear:rax40 (from the name) | before V1.0.6.106 | CNA record |
NETGEAR RAXE300 netgear:raxe300 (from the name) | before V1.0.9.82 | CNA record |
netgear rax30_firmware netgear:rax30_firmware | before 1.0.9.92 | NVD |
netgear rax35_firmware netgear:rax35_firmware | before 1.0.10.72 | NVD |
netgear rax38_firmware netgear:rax38_firmware | before 1.0.6.106 | NVD |
netgear rax40_firmware netgear:rax40_firmware | before 1.0.6.106 | NVD |
netgear raxe300_firmware netgear:raxe300_firmware | before 1.0.10.72 | NVD |
References
- https://www.netgear.com/support/product/rax30product, patch
- https://www.netgear.com/support/product/rax35product, patch
- https://www.netgear.com/support/product/rax38product, patch
- https://www.netgear.com/support/product/rax40product, patch
- https://www.netgear.com/support/product/raxe300product, patch
- https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisoryvendor-advisory, patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.