{"id":"CVE-2026-0404","state":"PUBLISHED","title":"Insufficient input validation in NETGEAR Orbi routers","description":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality allows network adjacent attackers authenticated \nover WiFi or on LAN to execute OS command injections on the router. \nDHCPv6 is not enabled by default.","publishedAt":"2026-01-13T16:01:14.944Z","updatedAt":"2026-02-26T15:04:43.482Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","source":"NETGEAR"},"assigner":"NETGEAR","products":["NETGEAR RBRE960","NETGEAR RBSE960","NETGEAR RBR850","NETGEAR RBS850","NETGEAR RBR860","NETGEAR RBS860","NETGEAR RBRE950","NETGEAR RBSE950","NETGEAR RBR750","NETGEAR RBS750","NETGEAR RBR840","NETGEAR RBS840"],"affected":[{"vendor":"NETGEAR","product":"RBRE960","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBSE960","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR850","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS850","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR860","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS860","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBRE950","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBSE950","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR750","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS750","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR840","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS840","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]}],"references":["https://www.netgear.com/support/product/rbre960","https://www.netgear.com/support/product/rbse960","https://www.netgear.com/support/product/rbr850","https://www.netgear.com/support/product/rbs850","https://www.netgear.com/support/product/rbr860","https://www.netgear.com/support/product/rbs860","https://www.netgear.com/support/product/rbre950","https://www.netgear.com/support/product/rbse950","https://www.netgear.com/support/product/rbr750","https://www.netgear.com/support/product/rbs750","https://www.netgear.com/support/product/rbr840","https://www.netgear.com/support/product/rbs840","https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0404.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0404","state":"PUBLISHED","datePublished":"2026-01-13T16:01:14.944Z","dateUpdated":"2026-02-26T15:04:43.482Z","assignerShortName":"NETGEAR","assignerOrgId":"a2826606-91e7-4eb6-899e-8484bd4575d5","dateReserved":"2025-12-03T04:16:10.186Z"},"containers":{"cna":{"title":"Insufficient input validation in NETGEAR Orbi routers","descriptions":[{"lang":"en","value":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality allows network adjacent attackers authenticated \nover WiFi or on LAN to execute OS command injections on the router. \nDHCPv6 is not enabled by default."}],"affected":[{"vendor":"NETGEAR","product":"RBRE960","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBSE960","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR850","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS850","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR860","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS860","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBRE950","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBSE950","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR750","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS750","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBR840","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]},{"vendor":"NETGEAR","product":"RBS840","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v7.2.8.5","versionType":"custom"}]}],"references":[{"url":"https://www.netgear.com/support/product/rbre960","tags":["patch","product"]},{"url":"https://www.netgear.com/support/product/rbse960","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbr850","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbs850","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbr860","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbs860","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbre950","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbse950","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbr750","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbs750","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbr840","tags":["product","patch"]},{"url":"https://www.netgear.com/support/product/rbs840","tags":["product","patch"]},{"url":"https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","baseScore":4.8,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"NETGEAR","orgId":"a2826606-91e7-4eb6-899e-8484bd4575d5","dateUpdated":"2026-01-13T16:22:30.971Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbre960:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbse960:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbr850:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbs850:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbr860:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbs860:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbre950:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbse950:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbr750:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbs750:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbr840:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:netgear:rbs840:*:*:*:*:*:*:*:*","versionEndExcluding":"v7.2.8.5","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Hyunseok Yun"}],"datePublic":"2026-01-13T16:00:00.000Z","impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Devices with automatic updates enabled may already have this patch \napplied. If not, please check the firmware version and update it to the \nlatest.</p>\n\n<p>Fixed in:</p>\n\n<p></p><p><span>RBR750</span><a href=\"https://www.netgear.com/support/product/rbr750\"> firmware v7.2.8.5 or later</a><br><span>RBR840 </span><a href=\"https://www.netgear.com/support/product/rbr840\">firmware v7.2.8.5 or later</a><br><span>RBR850 </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rbr850\">firmware v7.2.8.5 or later</a><br><span>RBR860 </span><a href=\"https://www.netgear.com/support/product/rbr860\">firmware v7.2.8.5 or later</a><br><span>RBS750 </span><a href=\"https://www.netgear.com/support/product/rbs750\">firmware v7.2.8.5 or later</a><br><span>RBS840 </span><a href=\"https://www.netgear.com/support/product/rbs840\">firmware v7.2.8.5 or later</a><br><span>RBS850 </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rbs850\">firmware v7.2.8.5 or later</a><br><span>RBS860 </span><a href=\"https://www.netgear.com/support/product/rbs860\">firmware v7.2.8.5 or later</a><br><span>RBRE950</span><a href=\"https://www.netgear.com/support/product/rbre950\"> firmware v7.2.8.5 or later</a><br><span>RBRE960 </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rbre960\">firmware v7.2.8.5 or later</a><br><span>RBSE950 </span><a href=\"https://www.netgear.com/support/product/rbse950\">firmware v7.2.8.5 or later</a><br><span>RBSE960 </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.netgear.com/support/product/rbse960\">firmware v7.2.8.5 or later</a></p><p></p>"}],"value":"Devices with automatic updates enabled may already have this patch \napplied. If not, please check the firmware version and update it to the \nlatest.\n\n\n\nFixed in:\n\n\n\n\n\nRBR750  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbr750 \nRBR840  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbr840 \nRBR850  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbr850 \nRBR860  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbr860 \nRBS750  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbs750 \nRBS840  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbs840 \nRBS850  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbs850 \nRBS860  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbs860 \nRBRE950  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbre950 \nRBRE960  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbre960 \nRBSE950  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbse950 \nRBSE960  firmware v7.2.8.5 or later https://www.netgear.com/support/product/rbse960"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-0404","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-14T04:57:22.559440Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T15:04:43.482Z"}}]}}}