CVE-2026-0404 MEDIUM

CVE-2026-0404: Insufficient input validation in NETGEAR Orbi routers

Vendor Netgear
Product RBRE960
Weakness CWE-20 · Input validation
Published January 13, 2026
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

What the vulnerability does

01Description

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

Key dates

02Disclosure timeline

January 13, 2026 CVE published
February 26, 2026 Record updated