CVE-2026-9212: NETGEAR LBR1020 Firmware

High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days.

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

Affected products

NETGEAR LBR1020 Firmware: before 2.6.4.60 (fixed in 2.6.4.60)
NETGEAR LBR20 Firmware: before 2.7.6.8 (fixed in 2.7.6.8)
NETGEAR r6700ax Firmware: affected versions not specified
NETGEAR r7800 Firmware: before 1.0.4.96 (fixed in 1.0.4.96)
NETGEAR r9000 Firmware: before 1.0.6.46 (fixed in 1.0.6.46)
NETGEAR RAX10 Firmware: before 1.0.5.50 (fixed in 1.0.5.50)
NETGEAR RAX120 Firmware: before 1.2.10.56 (fixed in 1.2.10.56)
NETGEAR RAX36S Firmware: before 1.0.5.50 (fixed in 1.0.5.50)
NETGEAR RAX70 Firmware: before 1.0.19.172 (fixed in 1.0.19.172)
NETGEAR RAX78 Firmware: before 1.0.19.172 (fixed in 1.0.19.172)
NETGEAR RBR10 Firmware: affected versions not specified
NETGEAR RBR20 Firmware: affected versions not specified
NETGEAR RBR350 Firmware: before 4.4.2.1 (fixed in 4.4.2.1)
NETGEAR RBR40 Firmware: affected versions not specified
NETGEAR RBR50 Firmware: affected versions not specified
NETGEAR RBS10 Firmware: affected versions not specified
NETGEAR RBS20 Firmware: affected versions not specified
NETGEAR RBS350 Firmware: before 4.4.2.1 (fixed in 4.4.2.1)
NETGEAR RBS40 Firmware: affected versions not specified
NETGEAR RBS50 Firmware: affected versions not specified
NETGEAR XR450 Firmware: before 2.3.3.136 (fixed in 2.3.3.136)
NETGEAR XR500 Firmware: before 2.3.3.136 (fixed in 2.3.3.136)

Published 2026-06-09. Last modified 2026-07-23.