{"id":"CVE-2026-9215","title":"A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations …","summary":"A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations …","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","cwe":["CWE-352"],"vendor":"netgear","product":"xr1000_firmware","affected":["xr1000_firmware < 1.1.0.22","xr1000v2_firmware < 1.1.0.22","xr500_firmware < 2.3.5.152"],"patched":["xr1000_firmware 1.1.0.22","xr1000v2_firmware 1.1.0.22","xr500_firmware 2.3.5.152"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T21:20:24.780","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9215","references":[{"url":"https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr1000v2","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/xr500","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd","cve.org"],"epss":0.00122,"epssPercentile":0.02303,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T18:26:12.430605Z"},"ingestedAt":"2026-09-08T19:08:49.634Z","slug":"CVE-2026-9215","body":"## Overview\n\nA cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.\n\n## Affected\n\n- `xr1000_firmware < 1.1.0.22`\n- `xr1000v2_firmware < 1.1.0.22`\n- `xr500_firmware < 2.3.5.152`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `xr1000_firmware 1.1.0.22`\n- `xr1000v2_firmware 1.1.0.22`\n- `xr500_firmware 2.3.5.152`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202636,"id":"CVE-2026-9215","ts":1789400099587,"field":"cvss","old":"6.4","new":"6.7"},{"seq":201363,"id":"CVE-2026-9215","ts":1789397621354,"field":"cvss","old":"6.7","new":"6.4"},{"seq":200056,"id":"CVE-2026-9215","ts":1789395587681,"field":"cvss","old":"6.4","new":"6.7"},{"seq":199293,"id":"CVE-2026-9215","ts":1789392261375,"field":"cvss","old":"6.7","new":"6.4"},{"seq":197626,"id":"CVE-2026-9215","ts":1789384304276,"field":"cvss","old":"6.4","new":"6.7"},{"seq":196900,"id":"CVE-2026-9215","ts":1789383784253,"field":"cvss","old":"6.7","new":"6.4"},{"seq":195804,"id":"CVE-2026-9215","ts":1789380595102,"field":"cvss","old":"6.4","new":"6.7"},{"seq":194755,"id":"CVE-2026-9215","ts":1789378790533,"field":"cvss","old":"6.7","new":"6.4"},{"seq":193542,"id":"CVE-2026-9215","ts":1789376545830,"field":"cvss","old":"6.4","new":"6.7"},{"seq":192329,"id":"CVE-2026-9215","ts":1789373640362,"field":"cvss","old":"6.7","new":"6.4"},{"seq":191114,"id":"CVE-2026-9215","ts":1789369511385,"field":"cvss","old":"6.4","new":"6.7"},{"seq":189901,"id":"CVE-2026-9215","ts":1789368461912,"field":"cvss","old":"6.7","new":"6.4"},{"seq":188684,"id":"CVE-2026-9215","ts":1789365245321,"field":"cvss","old":"6.4","new":"6.7"},{"seq":187471,"id":"CVE-2026-9215","ts":1789363481231,"field":"cvss","old":"6.7","new":"6.4"},{"seq":186257,"id":"CVE-2026-9215","ts":1789361249255,"field":"cvss","old":"6.4","new":"6.7"},{"seq":185044,"id":"CVE-2026-9215","ts":1789358395858,"field":"cvss","old":"6.7","new":"6.4"},{"seq":183293,"id":"CVE-2026-9215","ts":1789354333590,"field":"cvss","old":"6.4","new":"6.7"},{"seq":182086,"id":"CVE-2026-9215","ts":1789353336220,"field":"cvss","old":"6.7","new":"6.4"},{"seq":180879,"id":"CVE-2026-9215","ts":1789350306859,"field":"cvss","old":"6.4","new":"6.7"},{"seq":179672,"id":"CVE-2026-9215","ts":1789348309570,"field":"cvss","old":"6.7","new":"6.4"},{"seq":178465,"id":"CVE-2026-9215","ts":1789346386542,"field":"cvss","old":"6.4","new":"6.7"},{"seq":177258,"id":"CVE-2026-9215","ts":1789343189536,"field":"cvss","old":"6.7","new":"6.4"},{"seq":175375,"id":"CVE-2026-9215","ts":1789334899063,"field":"cvss","old":"6.4","new":"6.7"},{"seq":174170,"id":"CVE-2026-9215","ts":1789333714324,"field":"cvss","old":"6.7","new":"6.4"},{"seq":172984,"id":"CVE-2026-9215","ts":1789331108462,"field":"cvss","old":"6.4","new":"6.7"},{"seq":171798,"id":"CVE-2026-9215","ts":1789328794281,"field":"cvss","old":"6.7","new":"6.4"},{"seq":170593,"id":"CVE-2026-9215","ts":1789327223614,"field":"cvss","old":"6.4","new":"6.7"},{"seq":169388,"id":"CVE-2026-9215","ts":1789323856637,"field":"cvss","old":"6.7","new":"6.4"},{"seq":168183,"id":"CVE-2026-9215","ts":1789319726406,"field":"cvss","old":"6.4","new":"6.7"},{"seq":166978,"id":"CVE-2026-9215","ts":1789318783292,"field":"cvss","old":"6.7","new":"6.4"},{"seq":165773,"id":"CVE-2026-9215","ts":1789315822907,"field":"cvss","old":"6.4","new":"6.7"},{"seq":164568,"id":"CVE-2026-9215","ts":1789313646844,"field":"cvss","old":"6.7","new":"6.4"},{"seq":163363,"id":"CVE-2026-9215","ts":1789311920995,"field":"cvss","old":"6.4","new":"6.7"},{"seq":162158,"id":"CVE-2026-9215","ts":1789308742009,"field":"cvss","old":"6.7","new":"6.4"},{"seq":160271,"id":"CVE-2026-9215","ts":1789300480899,"field":"cvss","old":"6.4","new":"6.7"},{"seq":159332,"id":"CVE-2026-9215","ts":1789299590573,"field":"cvss","old":"6.7","new":"6.4"},{"seq":158258,"id":"CVE-2026-9215","ts":1789296646437,"field":"cvss","old":"6.4","new":"6.7"},{"seq":157260,"id":"CVE-2026-9215","ts":1789294773141,"field":"cvss","old":"6.7","new":"6.4"},{"seq":156055,"id":"CVE-2026-9215","ts":1789292987091,"field":"cvss","old":"6.4","new":"6.7"},{"seq":154850,"id":"CVE-2026-9215","ts":1789289817783,"field":"cvss","old":"6.7","new":"6.4"},{"seq":152101,"id":"CVE-2026-9215","ts":1789277648183,"field":"cvss","old":"6.4","new":"6.7"},{"seq":151062,"id":"CVE-2026-9215","ts":1789276264309,"field":"cvss","old":"6.7","new":"6.4"},{"seq":150029,"id":"CVE-2026-9215","ts":1789273851253,"field":"cvss","old":"6.4","new":"6.7"},{"seq":148996,"id":"CVE-2026-9215","ts":1789271364771,"field":"cvss","old":"6.7","new":"6.4"},{"seq":147025,"id":"CVE-2026-9215","ts":1789269411091,"field":"cvss","old":"6.4","new":"6.7"},{"seq":145831,"id":"CVE-2026-9215","ts":1789266351325,"field":"cvss","old":"6.7","new":"6.4"},{"seq":144735,"id":"CVE-2026-9215","ts":1789262633958,"field":"cvss","old":"6.4","new":"6.7"},{"seq":143639,"id":"CVE-2026-9215","ts":1789261540075,"field":"cvss","old":"6.7","new":"6.4"},{"seq":142470,"id":"CVE-2026-9215","ts":1789258857889,"field":"cvss","old":"6.4","new":"6.7"},{"seq":141311,"id":"CVE-2026-9215","ts":1789256739618,"field":"cvss","old":"6.7","new":"6.4"}]}