CVE-2026-0404

No fix known EPSS 1%CVSS 4.8

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

Published 2026-01-13 · CVE record · OSV

Products: NETGEAR RBRE960, NETGEAR RBSE960, NETGEAR RBR850, NETGEAR RBS850, NETGEAR RBR860, NETGEAR RBS860, NETGEAR RBRE950, NETGEAR RBSE950, NETGEAR RBR750, NETGEAR RBS750, NETGEAR RBR840, NETGEAR RBS840