CVE-2026-0403

HIGH WAF: Medium
CVSS 8.0 Published: 2026-01-13
CWE-20

An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.

WAF Coverage Analysis

Improper Input Validation Medium WAF Coverage

OWASP: A03:2021 Injection

920xxx - Protocol Enforcement 941xxx - XSS / XXE 942xxx - SQL Injection

Affected Software

VendorProductVersion
netgearrbe971_firmwareup to 9.10.0.2
netgearrbe970_firmwareup to 9.10.0.2
netgearrbr750_firmwareup to 7.2.8.5
netgearrbr850_firmwareup to 7.2.8.5
netgearrbr860_firmwareup to 7.2.8.5
netgearrbs750_firmwareup to 7.2.8.5
netgearrbs850_firmwareup to 7.2.8.5
netgearrbs860_firmwareup to 7.2.8.5
netgearrbre960_firmwareup to 7.2.8.5
netgearrbse960_firmwareup to 7.2.8.5

References

Back to CVE Database