← back
CVE-2026-0403

Insufficient input validation in NETGEAR Orbi routers

CVSS 1.1 LOWEPSS 0.3%CWE-20
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Affected products
NETGEAR · RBE970NETGEAR · RBE971NETGEAR · RBR750NETGEAR · RBR850NETGEAR · RBR860NETGEAR · RBRE960NETGEAR · RBS750NETGEAR · RBS850NETGEAR · RBS860NETGEAR · RBSE960

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisoryhttps://www.netgear.com/support/product/rbe970https://www.netgear.com/support/product/rbe971https://www.netgear.com/support/product/rbr750https://www.netgear.com/support/product/rbr850https://www.netgear.com/support/product/rbr860https://www.netgear.com/support/product/rbre960https://www.netgear.com/support/product/rbs750https://www.netgear.com/support/product/rbs850https://www.netgear.com/support/product/rbs860https://www.netgear.com/support/product/rbse960