CVE-2026-9216

Analyzed Analyzed - Analysis Complete

Insufficient Input Validation in NETGEAR RAX Series

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: Netgear, Inc.

Description

An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-30

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-9216

Affected Vendors & Products

Vendor	Product	Version / Range
netgear	rax30_firmware	to 1.0.9.92 (exc)
netgear	rax35_firmware	to 1.0.10.72 (exc)
netgear	rax38_firmware	to 1.0.6.106 (exc)
netgear	rax40_firmware	to 1.0.6.106 (exc)
netgear	raxe300_firmware	to 1.0.10.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is an insufficient input validation issue in NETGEAR RAX series routers. A nearby attacker with network access (like WiFi credentials) can crash the router's management UI. It does not affect core services like WiFi network availability or compromise confidentiality or integrity.

Detection Guidance

This vulnerability can be detected by checking the firmware version of your NETGEAR RAX series router. If the management UI crashes when accessing the router's admin panel, it may indicate exploitation. No specific commands are provided in the context.

Impact Analysis

The main impact is temporary unavailability of the router's management interface. Users may be unable to access or change settings until the UI restarts. Core functions like WiFi and internet access remain operational.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards since it does not involve data breaches or integrity loss. However, temporary UI unavailability could disrupt administrative oversight.

Mitigation Strategies

Update the router's firmware to the latest version provided by NETGEAR. Ensure automatic updates are enabled if available. Monitor the router's management UI for crashes and restart the router if necessary.

Hi! I’m here to help you understand CVE-2026-9216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70