CVE-2026-0404mediumCWE-20

CVE-2026-0404: medium-severity vulnerability in NETGEAR RBR750

Insufficient input validation in NETGEAR Orbi routers

Published · Updated

Follow this CVE+ Monitor RBRE960+ Monitor RBSE960

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 1.1%
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Affected products
NETGEAR · RBR750NETGEAR · RBR840NETGEAR · RBR850NETGEAR · RBR860NETGEAR · RBRE950NETGEAR · RBRE960NETGEAR · RBS750NETGEAR · RBS840NETGEAR · RBS850NETGEAR · RBS860NETGEAR · RBSE950NETGEAR · RBSE960
Related CVEs — NETGEAR RBR750

In the same product, most dangerous first.

CVE-2026-0405MEDIUMAuthentication Bypass in NETGEAR Orbi DevicesEPSS 0.4%CVE-2026-0403LOWInsufficient input validation in NETGEAR Orbi routersEPSS 0.3%CVE-2026-0413MEDIUMBuffer overflow vulnerability in certain NETGEAR Nighthawk routersEPSS 0.3%CVE-2026-0418MEDIUMCertain NETGEAR devices allow administrators to tamper with systemEPSS 0.2%CVE-2026-0415MEDIUMInsufficient input validation vulnerability in certain Orbi routersEPSS 0.2%