CVE-2026-0404

published 2026-01-13

CVE-2026-0404: An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on…

medium 4.8 CVSS 4.0

AV A AC L AT P PR L UI N VC H VI H VA H SC N SI N SA N E U CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU N R U V D RE M U Amber

An insufficient input validation vulnerability in NETGEAR Orbi devices'
DHCPv6 functionality allows network adjacent attackers authenticated
over WiFi or on LAN to execute OS command injections on the router.
DHCPv6 is not enabled by default.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
netgear	rbr750	< v7.2.8.5	v7.2.8.5
netgear	rbr750_firmware	< 7.2.8.5	7.2.8.5
netgear	rbr840	< v7.2.8.5	v7.2.8.5
netgear	rbr840_firmware	< 7.2.8.5	7.2.8.5
netgear	rbr850	< v7.2.8.5	v7.2.8.5
netgear	rbr850_firmware	< 7.2.8.5	7.2.8.5
netgear	rbr860	< v7.2.8.5	v7.2.8.5
netgear	rbr860_firmware	< 7.2.8.5	7.2.8.5
netgear	rbre950	< v7.2.8.5	v7.2.8.5
netgear	rbre950_firmware	< 7.2.8.5	7.2.8.5
netgear	rbre960	< v7.2.8.5	v7.2.8.5
netgear	rbre960_firmware	< 7.2.8.5	7.2.8.5
netgear	rbs750	< v7.2.8.5	v7.2.8.5
netgear	rbs750_firmware	< 7.2.8.5	7.2.8.5
netgear	rbs840	< v7.2.8.5	v7.2.8.5
netgear	rbs840_firmware	< 7.2.8.5	7.2.8.5
netgear	rbs850	< v7.2.8.5	v7.2.8.5
netgear	rbs850_firmware	< 7.2.8.5	7.2.8.5
netgear	rbs860	< v7.2.8.5	v7.2.8.5
netgear	rbs860_firmware	< 7.2.8.5	7.2.8.5
netgear	rbse950	< v7.2.8.5	v7.2.8.5
netgear	rbse950_firmware	< 7.2.8.5	7.2.8.5
netgear	rbse960	< v7.2.8.5	v7.2.8.5
netgear	rbse960_firmware	< 7.2.8.5	7.2.8.5

CWE-20