{"id":"CVE-2026-0404","aliases":["EUVD-2026-2224","GHSA-jvf4-gm9f-33g9"],"status":"published","title":"Insufficient input validation in NETGEAR Orbi routers","description":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality allows network adjacent attackers authenticated \nover WiFi or on LAN to execute OS command injections on the router. \nDHCPv6 is not enabled by default.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01062,"percentile":0.64841,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2026-01-13T16:01:14Z","modified":"2026-06-17T10:10:45Z","products":[{"vendor":"netgear","product":"rbr750"},{"vendor":"netgear","product":"rbr750_firmware"},{"vendor":"netgear","product":"rbr840"},{"vendor":"netgear","product":"rbr840_firmware"},{"vendor":"netgear","product":"rbr850"},{"vendor":"netgear","product":"rbr850_firmware"},{"vendor":"netgear","product":"rbr860"},{"vendor":"netgear","product":"rbr860_firmware"},{"vendor":"netgear","product":"rbre950"},{"vendor":"netgear","product":"rbre950_firmware"},{"vendor":"netgear","product":"rbre960"},{"vendor":"netgear","product":"rbre960_firmware"},{"vendor":"netgear","product":"rbs750"},{"vendor":"netgear","product":"rbs750_firmware"},{"vendor":"netgear","product":"rbs840"},{"vendor":"netgear","product":"rbs840_firmware"},{"vendor":"netgear","product":"rbs850"},{"vendor":"netgear","product":"rbs850_firmware"},{"vendor":"netgear","product":"rbs860"},{"vendor":"netgear","product":"rbs860_firmware"},{"vendor":"netgear","product":"rbse950"},{"vendor":"netgear","product":"rbse950_firmware"},{"vendor":"netgear","product":"rbse960"},{"vendor":"netgear","product":"rbse960_firmware"}],"references":[{"url":"https://www.netgear.com/support/product/rbre960","tags":["patch","product","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbse960","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbr850","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbs850","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbr860","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbs860","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbre950","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbse950","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbr750","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbs750","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbr840","tags":["product","patch","Patch","Product"]},{"url":"https://www.netgear.com/support/product/rbs840","tags":["product","patch","Patch","Product"]},{"url":"https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory","tags":["vendor-advisory","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0404"},{"url":"https://github.com/advisories/GHSA-jvf4-gm9f-33g9"}],"sources":{"cve":[{"id":"CVE-2026-0404","title":"Insufficient input validation in NETGEAR Orbi routers","description":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality allows network adjacent attackers authenticated \nover WiFi or on LAN to execute OS command injections on the router. \nDHCPv6 is not enabled by default.","status":"published","published":"2026-01-13T16:01:14.944Z","modified":"2026-02-26T15:04:43.482Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-2224","description":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality allows network adjacent attackers authenticated \nover WiFi or on LAN to execute OS command injections on the router. \nDHCPv6 is not enabled by default.","status":"published","published":"2026-01-13T16:01:14Z","modified":"2026-02-26T15:04:43Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-02T19:48:26.495238Z"}],"ghsa":[{"id":"GHSA-jvf4-gm9f-33g9","title":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality...","description":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality allows network adjacent attackers authenticated \nover WiFi or on LAN to execute OS command injections on the router. \nDHCPv6 is not enabled by default.","status":"published","published":"2026-01-13T18:31:07Z","modified":"2026-02-12T18:30:19Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","level":"medium"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:06:11.04945Z"}],"nvd":[{"id":"CVE-2026-0404","description":"An insufficient input validation vulnerability in NETGEAR Orbi devices' \nDHCPv6 functionality allows network adjacent attackers authenticated \nover WiFi or on LAN to execute OS command injections on the router. \nDHCPv6 is not enabled by default.","status":"published","published":"2026-01-13T16:16:10.343Z","modified":"2026-06-17T10:10:45.53Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","level":"medium","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:03.683495Z"}]}}