CVE-2026-0405
Authentication Bypass in NETGEAR Orbi Devices
CVE-2026-0405 is a medium vulnerability (CVSS 6.1) in Netgear Cbr750, published January 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.
- Severity
- 6.1 MediumCVSS 4.0, CVE List
- Exploit chance
- 0.36%EPSS, 30th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- netgear cbr750
- netgear cbr750 firmware
- netgear nbr750
- netgear nbr750 firmware
- netgear rbe370
- netgear rbe370 firmware
- netgear rbe371
- netgear rbe371 firmware
- netgear rbe372
- netgear rbe372 firmware
- netgear rbe373
- netgear rbe373 firmware
Show 38 moreShow less
- netgear rbe374
- netgear rbe374 firmware
- netgear rbe770
- netgear rbe770 firmware
- netgear rbe771
- netgear rbe771 firmware
- netgear rbe772
- netgear rbe772 firmware
- netgear rbe773
- netgear rbe773 firmware
- netgear rbe970
- netgear rbe970 firmware
- netgear rbe971
- netgear rbe971 firmware
- netgear rbr750
- netgear rbr750 firmware
- netgear rbr840
- netgear rbr840 firmware
- netgear rbr850
- netgear rbr850 firmware
- netgear rbr860
- netgear rbr860 firmware
- netgear rbre950
- netgear rbre950 firmware
- netgear rbre960
- netgear rbre960 firmware
- netgear rbs750
- netgear rbs750 firmware
- netgear rbs840
- netgear rbs840 firmware
- netgear rbs850
- netgear rbs850 firmware
- netgear rbs860
- netgear rbs860 firmware
- netgear rbse950
- netgear rbse950 firmware
- netgear rbse960
- netgear rbse960 firmware
What each source reports
CVE List Score used
Authentication Bypass in NETGEAR Orbi Devices
An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.
- Record
CVE-2026-0405- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2026-2237
An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.
- Record
EUVD-2026-2237- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2cqm-696m-6jx3
An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the...
An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.
- Record
GHSA-2cqm-696m-6jx3- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.
- Record
CVE-2026-0405- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
netgear.com/support/product/rbe971
Show 22 moreShow less
kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory
nvd.nist.gov/vuln/detail/CVE-2026-0405
github.com/advisories/GHSA-2cqm-696m-6jx3