CVE-2026-9215 LOW

CVE-2026-9215: A CSRF vulnerability exists in certain NETGEAR XR series devices

Vendor Netgear
Product XR1000
Weakness CWE-352 · CSRF
Published September 8, 2026
Last update September 9, 2026
View on NVD All CVEs

CVSS base score

1.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber

What the vulnerability does

01Description

A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.

Key dates

02Disclosure timeline

September 8, 2026 CVE published
September 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-64791 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager CVE-2026-81271 WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-57784 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match