CVE-2026-0406 MEDIUM

CVE-2026-0406: Insufficient input validation in NETGEAR Nighthawk router XR1000v2

Vendor Netgear

Product XR1000v2

Weakness CWE-20 · Input validation

Published January 13, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:U/V:D/RE:M/U:Amber

What the vulnerability does

01Description

An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command injections.

Key dates

02Disclosure timeline

January 13, 2026 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-0406 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/20.html

Related vulnerabilities

CVE-2026-0406: Insufficient input validation in NETGEAR Nighthawk router XR1000v2

01Description

02Disclosure timeline

03References

04Related CVE