{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-9213",
        "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
        "state": "PUBLISHED",
        "assignerShortName": "NETGEAR",
        "dateReserved": "2026-05-21T17:29:06.017Z",
        "datePublished": "2026-06-09T15:50:46.744Z",
        "dateUpdated": "2026-06-11T05:15:19.347Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
                "shortName": "NETGEAR",
                "dateUpdated": "2026-06-11T05:15:19.347Z"
            },
            "title": "Insufficient input validation in certain NETGEAR routers",
            "datePublic": "2026-06-09T00:00:00.000Z",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-20",
                            "description": "CWE-20 Insufficient input validation",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-248",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-248 Command Injection"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "NETGEAR",
                    "product": "MR70",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "V1.0.4.48",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                },
                {
                    "vendor": "NETGEAR",
                    "product": "MS70",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "V1.0.4.48",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                },
                {
                    "vendor": "NETGEAR",
                    "product": "RAXE500",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "V1.2.14.114",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                },
                {
                    "vendor": "NETGEAR",
                    "product": "XR1000",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "V1.0.2.86",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p><span>A vulnerability in</span><span>&nbsp;the affected&nbsp;</span><span>NETGEAR gaming routers allows</span><span>&nbsp;</span><span>attackers with</span><span>&nbsp;</span><span>the ability to intercept and tamper with traffic between</span><span>&nbsp;</span><span>the router and the I</span><span>nternet, to execute code on the device.</span></p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://www.netgear.com/support/product/mr70/",
                    "tags": [
                        "product",
                        "patch"
                    ]
                },
                {
                    "url": "https://www.netgear.com/support/product/ms70/",
                    "tags": [
                        "product",
                        "patch"
                    ]
                },
                {
                    "url": "https://www.netgear.com/support/product/raxe500/",
                    "tags": [
                        "product",
                        "patch"
                    ]
                },
                {
                    "url": "https://www.netgear.com/support/product/xr1000/",
                    "tags": [
                        "product",
                        "patch"
                    ]
                },
                {
                    "url": "https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory",
                    "tags": [
                        "vendor-advisory"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV4_0": {
                        "attackVector": "NETWORK",
                        "attackComplexity": "HIGH",
                        "attackRequirements": "PRESENT",
                        "privilegesRequired": "NONE",
                        "userInteraction": "NONE",
                        "vulnConfidentialityImpact": "HIGH",
                        "subConfidentialityImpact": "NONE",
                        "vulnIntegrityImpact": "HIGH",
                        "subIntegrityImpact": "NONE",
                        "vulnAvailabilityImpact": "NONE",
                        "subAvailabilityImpact": "NONE",
                        "exploitMaturity": "UNREPORTED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "valueDensity": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "version": "4.0",
                        "baseSeverity": "MEDIUM",
                        "baseScore": 6.9,
                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
                    }
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionMR70 Nighthawk Mesh WiFi 6 Router V1.0.4.48 https://www.netgear.com/support/product/mr70/ MS70 Nighthawk Mesh WiFi 6 Add-on Satellite V1.0.4.48 https://www.netgear.com/support/product/ms70/ RAXE500 Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router V1.2.14.114 https://www.netgear.com/support/product/raxe500/ XR1000 Nighthawk WiFi 6 Pro Gaming Router V1.0.2.86 https://www.netgear.com/support/product/xr1000/",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:</p><table><thead><tr><th>Product</th><th>Fixed Version</th></tr></thead><tbody><tr><td><b>MR70</b> Nighthawk Mesh WiFi 6 Router</td><td><a href=\"https://www.netgear.com/support/product/mr70/\">V1.0.4.48</a></td></tr><tr><td><b>MS70</b> Nighthawk Mesh WiFi 6 Add-on Satellite</td><td><a href=\"https://www.netgear.com/support/product/ms70/\">V1.0.4.48</a></td></tr><tr><td><b>RAXE500</b> Nighthawk AX12 12-Stream AXE11000 Tri-Band WiFi 6E Router</td><td><a href=\"https://www.netgear.com/support/product/raxe500/\">V1.2.14.114</a></td></tr><tr><td><b>XR1000</b> Nighthawk WiFi 6 Pro Gaming Router</td><td><a href=\"https://www.netgear.com/support/product/xr1000/\">V1.0.2.86</a></td></tr></tbody></table>"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "fluorescent",
                    "type": "finder"
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.3"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-06-09T00:00:00+00:00",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3",
                                "id": "CVE-2026-9213"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-06-10T03:59:25.150Z"
                }
            }
        ]
    }
}