CVE-2026-0403
Insufficient input validation in NETGEAR Orbi routers
- Published
- Updated
- Reserved
- Assigned by
- NETGEAR
Description
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NETGEARCNA (assigner) | 4.0 | Low1.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber |
| NVDNVD · Analyzed | 4.0 | Low1.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 1.1.
Weakness
Affected products
- affected ≤ 4.6.14.3
- affected ≤ 4.6.14.3
- affected < v7.2.7.15
- affected < v7.2.7.15
- affected < V7.2.8.5
- affected < V7.2.8.5
- affected < v9.10.0.2
- affected < v9.10.0.2
- affected < v7.2.8.5
- affected < v7.2.8.5
What to do
Solution: Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: RBE971 firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe971 RBE970 firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe970 RBR750 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr750 RBR850 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr850 RBR860 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr860 RBS750 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs750 RBS850 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs850 RBS860 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs860 RBRE960 firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbre960 RBSE960 firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbse960
References (11)
- https://www.netgear.com/support/product/rbr750 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbs750 (opens in a new tab)patchproduct
- https://www.netgear.com/support/product/rbre960 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbse960 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbr850 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbs850 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbe971 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbe970 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbr860 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbs860 (opens in a new tab)productpatch
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory (opens in a new tab)vendor-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-0403)Record last updated .