Read the docs
TI-2026-00273 Aliases CVE-2026-0411GHSA-j8rf-h5jg-xxh6

A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi Satellites

Priority LOW 21CWE-200Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to gain administrator access to the Orbi router. The listed NETGEAR models are affected by this vulnerability. Orbi WiFi Systems without satellite devices are not impacted by this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Fix Fixed RBE970 (NETGEAR): 6.3.8.11RBR350 (NETGEAR): V4.4.2.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARRBE970before 6.3.8.116.3.8.11Patch availableCNA
NETGEARRBR350before V4.4.2.2V4.4.2.2Patch availableCNA
NETGEARRBR760before V6.3.8.11V6.3.8.11Patch availableCNA
NETGEARRBS350before V4.4.2.2V4.4.2.2Patch availableCNA
NETGEARRBS760before V6.3.8.11V6.3.8.11Patch availableCNA
  • RBE970 VendorNETGEAR Affected before 6.3.8.11 Fixed in 6.3.8.11 Patch available CNA
  • RBR350 VendorNETGEAR Affected before V4.4.2.2 Fixed in V4.4.2.2 Patch available CNA
  • RBR760 VendorNETGEAR Affected before V6.3.8.11 Fixed in V6.3.8.11 Patch available CNA
  • RBS350 VendorNETGEAR Affected before V4.4.2.2 Fixed in V4.4.2.2 Patch available CNA
  • RBS760 VendorNETGEAR Affected before V6.3.8.11 Fixed in V6.3.8.11 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:netgear:rbe970_firmware:*:*:*:*:*:*:*:*before 9.13.2.1VulnerableNETGEAR
cpe:2.3:h:netgear:rbe970:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr350_firmware:*:*:*:*:*:*:*:*before 4.4.2.2VulnerableNETGEAR
cpe:2.3:h:netgear:rbr350:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr760_firmware:*:*:*:*:*:*:*:*before 6.3.8.11VulnerableNETGEAR
cpe:2.3:h:netgear:rbr760:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs350_firmware:*:*:*:*:*:*:*:*before 4.4.2.2VulnerableNETGEAR
cpe:2.3:h:netgear:rbs350:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs760_firmware:*:*:*:*:*:*:*:*before 6.3.8.11VulnerableNETGEAR
cpe:2.3:h:netgear:rbs760:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:rbe970_firmware:*:*:*:*:*:*:*:* Versions before 9.13.2.1 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbe970:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr350_firmware:*:*:*:*:*:*:*:* Versions before 4.4.2.2 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr760_firmware:*:*:*:*:*:*:*:* Versions before 6.3.8.11 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr760:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs350_firmware:*:*:*:*:*:*:*:* Versions before 4.4.2.2 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs760_firmware:*:*:*:*:*:*:*:* Versions before 6.3.8.11 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs760:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

  • Fix · CNA RBE970 (NETGEAR) Fixed in 6.3.8.11
  • Fix · CNA RBR350 (NETGEAR) Fixed in V4.4.2.2
  • Fix · CNA RBR760 (NETGEAR) Fixed in V6.3.8.11
  • Fix · CNA RBS350 (NETGEAR) Fixed in V4.4.2.2
  • Fix · CNA RBS760 (NETGEAR) Fixed in V6.3.8.11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    NETGEAR RBE970, RBR350, RBS350 — kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-08097 Insufficient authentication and input validation in certain NETGEAR productsPriority LOW 27
    • TI-2026-02668 Unauthenticated users can disrupt router operationPriority LOW 22
    • TI-2026-00276 Insufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR RoutersPriority LOW 21
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0411
  2. 2026-10-03 Alias added: GHSA-j8rf-h5jg-xxh6

References

Patch 5

Advisory 1

  • TI-2026-00267 Authentication Bypass in NETGEAR Orbi Devices CVSS 4.0MEDIUM 6.1
  • TI-2026-02668 Unauthenticated users can disrupt router operation CVSS 4.0MEDIUM 4.9
  • TI-2026-00276 Insufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR Routers CVSS 4.0MEDIUM 4.3
  • TI-2026-00277 Insufficient input validation vulnerability in certain Orbi routers CVSS 4.0MEDIUM 4.3
  • TI-2026-00265 Insufficient input validation in NETGEAR Orbi routers CVSS 4.0LOW 1.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences