CVE-2026-9215

EUVD-2026-73163
A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
ADJACENT_NETWORK
LOW
LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.72%
Affected Products (NVD)
VendorProductVersion
netgearxr1000_firmware
𝑥
< 1.1.0.22
netgearxr1000v2_firmware
𝑥
< 1.1.0.22
netgearxr500_firmware
𝑥
< 2.3.5.152
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory
https://www.netgear.com/support/product/xr1000
https://www.netgear.com/support/product/xr1000v2
https://www.netgear.com/support/product/xr500