NETGEAR Gaming Routers CVE-2026-9213

The CVSS 4.0 Attack Requirements metric (AT:P) and description explicitly require the attacker to intercept and tamper with traffic between the router and the internet - a man-in-the-middle network position. This is not achievable by a standard remote attacker and requires one of: a compromised upstream routing device, BGP prefix hijacking, ARP/DNS poisoning within a shared network segment, or physical access to the network path. PR:N confirms no authentication credentials on the target router are required once this position is established. UI:N means no router administrator interaction is needed. Exploitation is limited by the AC:H requirement (high attack complexity) and the AT:P prerequisite - home users on residential ISPs with no shared upstream infrastructure are at lower practical risk than enterprise or ISP-adjacent deployments. The vulnerability does not appear to be exploitable by a standard internet-facing attacker without the specific on-path capability.

The CVSS 4.0 base score of 6.9 reflects a meaningful but constrained threat. The AC:H and AT:P modifiers together indicate that exploitation requires both technical sophistication and a specific network pre-positioning requirement (MitM), which substantially limits the attacker pool compared to a straightforward network-reachable vulnerability. The E:U (Exploit maturity: Unreported) metric confirms no known exploit code exists at scoring time, consistent with the absence of a CISA KEV listing. No EPSS score was provided in the intelligence data, so probabilistic exploitation likelihood cannot be quantified. The high confidentiality and integrity impacts (VC:H, VI:H) mean a successful compromise could yield full router control and access to all traffic routed through the device, making this a serious outcome if achieved. Real-world priority is moderate: organizations or individuals whose internet traffic transits untrusted upstream segments (e.g., shared ISP infrastructure, public Wi-Fi backhaul) face a more credible threat than those on controlled network paths. The 'Information Disclosure' tag may indicate a secondary impact not fully described in the CVE text - this is not independently confirmed.

An attacker with a man-in-the-middle position on the network path between the router and its upstream internet destination - achieved, for example, via BGP route hijacking, ARP poisoning of the gateway, or compromise of an ISP-level device - injects maliciously crafted responses to communications initiated by the router's firmware. The router's input validation failure (CWE-20) causes it to process the tampered data in a way that leads to arbitrary code execution on the device. No public exploit code has been identified at time of analysis, and replicating this attack requires non-trivial network access.