CVE-2026-0404 | BDVDB-2026-310331 Detail
NETGEARRBRE960
Description#
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.
Impact#
CAPEC-88 OS Command Injection
Weaknesses#
- CWE-20 Improper Input Validation
References#
- https://www.netgear.com/support/product/rbre960
- https://www.netgear.com/support/product/rbse960
- https://www.netgear.com/support/product/rbr850
- https://www.netgear.com/support/product/rbs850
- https://www.netgear.com/support/product/rbr860
- https://www.netgear.com/support/product/rbs860
- https://www.netgear.com/support/product/rbre950
- https://www.netgear.com/support/product/rbse950
- https://www.netgear.com/support/product/rbr750
- https://www.netgear.com/support/product/rbs750
- https://www.netgear.com/support/product/rbr840
- https://www.netgear.com/support/product/rbs840
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.