CVE-2026-9218: Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local…

PriorityP423medium4.5CVSS 3.1

AVAACLPRHUINSUCNIHAN

EPSS

0.18%

8.0th percentile

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
netgear	cbr40	< *	*
netgear	r7000	< v1.0.11.130	v1.0.11.130
netgear	r7000p	< V1.3.3.152	V1.3.3.152
netgear	rax40	< V1.0.3.64	V1.0.3.64

CVSS provenance

nvdv3.14.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

nvdv4.04.3MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.