CVE-2026-0404

HIGH WAF: Medium
CVSS 8.0 Published: 2026-01-13
CWE-20

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

WAF Coverage Analysis

Improper Input Validation Medium WAF Coverage

OWASP: A03:2021 Injection

920xxx - Protocol Enforcement 941xxx - XSS / XXE 942xxx - SQL Injection

Affected Software

VendorProductVersion
netgearrbr750_firmwareup to 7.2.8.5
netgearrbr840_firmwareup to 7.2.8.5
netgearrbr850_firmwareup to 7.2.8.5
netgearrbr860_firmwareup to 7.2.8.5
netgearrbs750_firmwareup to 7.2.8.5
netgearrbs840_firmwareup to 7.2.8.5
netgearrbs850_firmwareup to 7.2.8.5
netgearrbs860_firmwareup to 7.2.8.5
netgearrbre950_firmwareup to 7.2.8.5
netgearrbre960_firmwareup to 7.2.8.5

References

Back to CVE Database