CVE-2026-9218

MediumCVSS 4.5

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Listed NETGEAR router models have insufficient input validation in the time server (NTP) setting. An attacker connected to the router's local network with administrator credentials can run unauthorized commands on the router. This impacts router integrity, with no impact on confidentiality or availability.

Risk Assessment

Someone with administrator credentials and local network access can alter router configuration and run unauthorized commands, affecting integrity. This requires administrator credentials.

Recommendation

Update NETGEAR router firmware to the latest version provided by the vendor. Protect administrator credentials and restrict local network access.

Other vulnerabilities in NETGEAR Router

CVE-2026-11732High
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability applies only when the Block Sites feature is turned on.

Original NVD description (English source)

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS