CVE-2026-9215

תיאור (מקור, אנגלית)

A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.

מדדים

CVSS 3.1

6.7 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

CVSS 4.0

1.8 (LOW) מקור הציון: CNA CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-11/10/2026

CWE

CWE-352

מוצרים מושפעים

netgear: xr1000 firmware; netgear: xr1000; netgear: xr1000v2 firmware; netgear: xr1000v2; netgear: xr500 firmware; netgear: xr500

קישורים

• https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory Vendor Advisory
• https://www.netgear.com/support/product/xr1000 Product
• https://www.netgear.com/support/product/xr1000v2 Product
• https://www.netgear.com/support/product/xr500 Product