PT-2026-2627 · NetGear · Netgear Orbi

Hyunseok Yun · Published 2026-01-13 · Updated 2026-01-13 · CVE-2026-0404

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR Orbi devices (affected versions not specified)

Description A flaw exists in the DHCPv6 functionality of NETGEAR Orbi devices due to insufficient input validation. This allows attackers located on the same network, authenticated via WiFi or LAN, to execute OS command injections on the router. DHCPv6 is not enabled by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-00541

CVE-2026-0404

Affected Products

Netgear Orbi

References · 17

• https://netgear.com/support/product/rbr860 · Patch
• https://netgear.com/support/product/rbs860 · Patch
• https://netgear.com/support/product/rbs850 · Patch
• https://netgear.com/support/product/rbs750 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-0404 · Security Note
• https://netgear.com/support/product/rbr750 · Patch
• https://netgear.com/support/product/rbre960 · Patch
• https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory · Vendor Advisory
• https://netgear.com/support/product/rbse950 · Patch
• https://netgear.com/support/product/rbse960 · Patch
• https://osv.dev/vulnerability/CVE-2026-0404 · Vendor Advisory
• https://netgear.com/support/product/rbr850 · Patch
• https://bdu.fstec.ru/vul/2026-00541 · Security Note
• https://netgear.com/support/product/rbr840 · Patch
• https://netgear.com/support/product/rbre950 · Patch