VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 13, 2026· Updated Feb 26, 2026

Insufficient input validation in NETGEAR Orbi routers

CVE-2026-0404

Description

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

Affected products

13
  • Netgear/Orbillm-create
  • NETGEAR/RBR750v5
    Range: 0
  • NETGEAR/RBR840v5
    Range: 0
  • NETGEAR/RBR850v5
    Range: 0
  • NETGEAR/RBR860v5
    Range: 0
  • NETGEAR/RBRE950v5
    Range: 0
  • NETGEAR/RBRE960v5
    Range: 0
  • NETGEAR/RBS750v5
    Range: 0
  • NETGEAR/RBS840v5
    Range: 0
  • NETGEAR/RBS850v5
    Range: 0
  • NETGEAR/RBS860v5
    Range: 0
  • NETGEAR/RBSE950v5
    Range: 0
  • NETGEAR/RBSE960v5
    Range: 0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.