Insufficient input validation in NETGEAR Orbi routers
Priority LOW 26CWE-20Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01062 64th percentileScored 2026-11-07
Fix Fixed RBRE960 (NETGEAR): v7.2.8.5RBSE960 (NETGEAR): v7.2.8.5+10 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NETGEAR | RBRE960 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBSE960 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBR850 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBS850 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBR860 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBS860 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBRE950 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBSE950 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBR750 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBS750 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBR840 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
| NETGEAR | RBS840 | before v7.2.8.5 | v7.2.8.5 | Patch available | CNA |
- RBRE960 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBSE960 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBR850 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBS850 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBR860 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBS860 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBRE950 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBSE950 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBR750 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBS750 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBR840 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
- RBS840 VendorNETGEAR Affected before v7.2.8.5 Fixed in v7.2.8.5 Patch available CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netgear:rbr750_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbr750:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbr840_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbr840:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbr850_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbr850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbr860_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbr860:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbs750_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbs750:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
- cpe:2.3:o:netgear:rbr750_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbr750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbr840_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbr840:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbr850_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbr850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbr860_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbr860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbs750_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbs750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netgear:rbs840_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbs840:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbs850_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbs850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbs860_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbs860:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbre950_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbre950:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbre960_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbre960:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbse950_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbse950:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:rbse960_firmware:*:*:*:*:*:*:*:* | before 7.2.8.5 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:rbse960:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
- cpe:2.3:o:netgear:rbs840_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbs840:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbs850_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbs850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbs860_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbs860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbre950_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbre950:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbre960_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbre960:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbse950_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbse950:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:rbse960_firmware:*:*:*:*:*:*:*:* Versions before 7.2.8.5 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:rbse960:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
Remediation
- Fix · CNA RBRE960 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBSE960 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBR850 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBS850 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBR860 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBS860 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBRE950 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBSE950 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBR750 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBS750 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBR840 (NETGEAR) Fixed in v7.2.8.5
- Fix · CNA RBS840 (NETGEAR) Fixed in v7.2.8.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
NETGEAR RBR750, RBR840 and 10 more products — kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advi…
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-00267 Authentication Bypass in NETGEAR Orbi DevicesPriority LOW 29
- TI-2026-00265 Insufficient input validation in NETGEAR Orbi routersPriority LOW 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-0404
- 2026-10-03 Alias added: GHSA-jvf4-gm9f-33g9
References
Patch 13
- https://www.netgear.com/support/product/rbre960
- https://www.netgear.com/support/product/rbse960
- https://www.netgear.com/support/product/rbr850
- https://www.netgear.com/support/product/rbs850
- https://www.netgear.com/support/product/rbr860
- https://www.netgear.com/support/product/rbs860
- https://www.netgear.com/support/product/rbre950
- https://www.netgear.com/support/product/rbse950
- https://www.netgear.com/support/product/rbr750
- https://www.netgear.com/support/product/rbs750
- https://www.netgear.com/support/product/rbr840
- https://www.netgear.com/support/product/rbs840
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory
More NETGEAR Rbr750 Firmware vulnerabilities
- TI-2023-26716 In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd. CVSS 3.1CRITICAL 9.8
- TI-2021-20709 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
- TI-2021-20699 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
- TI-2020-16329 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.6
- TI-2021-20717 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 10.0
- TI-2021-20708 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-0404 · CVE Program
- CVE-2026-0404 · NVD
- FIRST EPSS
- GHSA-jvf4-gm9f-33g9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences