All vulnerabilities
CVE-2026-9218

CBR40: Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access

NETGEAR CBR40Network & edge
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published13 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.

Text from CVE List

Affected versions 4

  • CBR40affected: and laterCVE List
  • R7000affected: all versions before v1.0.11.130CVE List
  • R7000Paffected: all versions before V1.3.3.152CVE List
  • RAX40affected: all versions before V1.0.3.64CVE List

References 5