{"id":"CVE-2026-9215","revision":"96a184ace7fb434680b9dc405dce054b","records":[{"revision":"96a184ace7fb434680b9dc405dce054b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-9215","aliases":[],"title":"A CSRF vulnerability exists in certain NETGEAR XR series devices","description":"A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows\u00A0an\u00A0attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.","state":0,"publishedAt":"2026-09-08T17:06:47.865+00:00","modifiedAt":"2026-10-13T16:33:16.019+00:00","affected":[{"ecosystem":"Vendor product","name":"XR1000v2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"NETGEAR\",\n                    \"product\": \"XR1000v2\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"V1.1.0.22\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"Vendor product","name":"XR500","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"NETGEAR\",\n                    \"product\": \"XR500\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"v2.3.5.152\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber","score":1.8,"severity":"LOW"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","score":6.7,"severity":"MEDIUM"}],"references":["https://www.netgear.com/support/product/xr500","https://www.netgear.com/support/product/xr1000","https://www.netgear.com/support/product/xr1000v2","https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-9215","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-9215","identifiers":["CVE-2026-9215"]},"retained":false,"historicalAffected":[]}],"coverage":[]}