A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.
Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:
| Product | Fixed Version |
|---|---|
| XR1000 Nighthawk WiFi 6 Pro Gaming Router | V1.1.0.22 |
| XR1000v2 Nighthawk WiFi 6 Pro Gaming Router | V1.1.0.22 |
| XR500 (EoS) Nighthawk Pro Gaming Router | v2.3.5.152 |
Models marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.
"}],"value":"Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionXR1000 Nighthawk WiFi 6 Pro Gaming Router V1.1.0.22 https://www.netgear.com/support/product/xr1000 XR1000v2 Nighthawk WiFi 6 Pro Gaming Router V1.1.0.22 https://www.netgear.com/support/product/xr1000v2 XR500 (EoS) Nighthawk Pro Gaming Router v2.3.5.152 https://www.netgear.com/support/product/xr500 \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support."}],"source":{"discovery":"EXTERNAL"},"title":"A CSRF vulnerability exists in certain NETGEAR XR series devices","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"a2826606-91e7-4eb6-899e-8484bd4575d5","assignerShortName":"NETGEAR","cveId":"CVE-2026-9215","datePublished":"2026-09-08T17:06:47.865Z","dateReserved":"2026-05-21T17:29:08.100Z","dateUpdated":"2026-09-09T03:51:25.403Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-08 18:21:17","lastModifiedDate":"2026-09-11 21:20:24","problem_types":["CWE-352","CWE-352 CWE-352 Cross-Site request forgery (CSRF)"],"metrics":{"cvssMetricV40":[{"source":"a2826606-91e7-4eb6-899e-8484bd4575d5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber","baseScore":1.8,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"AMBER"}}],"cvssMetricV31":[{"source":"a2826606-91e7-4eb6-899e-8484bd4575d5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-08T18:26:12.430605Z","id":"CVE-2026-9215","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.1.0.22","matchCriteriaId":"80874BD7-33C7-481D-8A97-9A4B5E0144A5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:xr1000:-:*:*:*:*:*:*:*","matchCriteriaId":"4FD4ED11-4130-47DA-8A9D-55B8F6E3E213"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.1.0.22","matchCriteriaId":"79C9605E-5D93-4C78-A935-9894ED02CE22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:xr1000v2:-:*:*:*:*:*:*:*","matchCriteriaId":"697B2136-87A6-4E8F-8B5E-373B02E9D6D7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.5.152","matchCriteriaId":"EB08953B-4943-4DCF-98FF-810C3F4F7465"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:netgear:xr500:-:*:*:*:*:*:*:*","matchCriteriaId":"9E203D92-F97B-4F5B-B395-3A5DEDBF1C1C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"9215","Ordinal":"1","Title":"A CSRF vulnerability exists in certain NETGEAR XR series devices","CVE":"CVE-2026-9215","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"9215","Ordinal":"1","NoteData":"A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.","Type":"Description","Title":"A CSRF vulnerability exists in certain NETGEAR XR series devices"}]}}}