CVE-2026-0403: Insufficient input validation in NETGEAR Orbi routers

Published Jan 13, 2026
·
Updated

An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.

Affected Software

21 affected components
Netgear Orbi
All of the following
Netgear Rbe971 Firmware<9.10.0.2
Netgear Rbe971
All of the following
Netgear Rbe970 Firmware<9.10.0.2
Netgear Rbe970
All of the following
Netgear RBR750 firmware<7.2.8.5
Netgear RBR750
All of the following
Netgear Rbr850 Firmware<7.2.8.5
Netgear RBR850
All of the following
Netgear Rbr860 Firmware<7.2.8.5
Netgear Rbr860
All of the following
Netgear Rbs750 Firmware<7.2.8.5
Netgear RBS750
All of the following
Netgear Rbs850 Firmware<7.2.8.5
Netgear RBS850
All of the following
Netgear Rbs860 Firmware<7.2.8.5
Netgear Rbs860
All of the following
Netgear Rbre960 Firmware<7.2.8.5
Netgear RBRE960
All of the following
Netgear Rbse960 Firmware<7.2.8.5
Netgear RBSE960

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade NETGEAR Orbi RBE970 to a version that resolves this vulnerability.

    Fixed in 9.10.0.2
  2. Upgrade

    Upgrade NETGEAR Orbi RBE971 to a version that resolves this vulnerability.

    Fixed in 9.10.0.2
  3. Upgrade

    Upgrade NETGEAR Orbi RBR750 to a version that resolves this vulnerability.

    Fixed in 7.2.8.5
  4. Upgrade

    Upgrade NETGEAR Orbi RBR850 to a version that resolves this vulnerability.

    Fixed in 7.2.8.5
  5. Upgrade

    Upgrade NETGEAR Orbi RBR860 to a version that resolves this vulnerability.

    Fixed in 7.2.8.5
  6. Upgrade

    Upgrade NETGEAR Orbi RBRE960 to a version that resolves this vulnerability.

    Fixed in 7.2.7.15
  7. Upgrade

    Upgrade NETGEAR Orbi RBS750 to a version that resolves this vulnerability.

    Fixed in 7.2.8.5
  8. Upgrade

    Upgrade NETGEAR Orbi RBS850 to a version that resolves this vulnerability.

    Fixed in 7.2.8.5
  9. Upgrade

    Upgrade NETGEAR Orbi RBS860 to a version that resolves this vulnerability.

    Fixed in 7.2.8.5
  10. Upgrade

    Upgrade NETGEAR Orbi RBSE960 to a version that resolves this vulnerability.

    Fixed in 7.2.7.15

Event History

Jan 13, 2026
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-0403?

CVE-2026-0403 is classified as a high severity vulnerability due to its potential for OS command injection.

2

How do I fix CVE-2026-0403?

To fix CVE-2026-0403, ensure that your NETGEAR Orbi router firmware is updated to the latest version released by NETGEAR.

3

Who is affected by CVE-2026-0403?

CVE-2026-0403 affects users of NETGEAR Orbi routers who have not implemented necessary mitigations.

4

What type of attack can exploit CVE-2026-0403?

CVE-2026-0403 can be exploited through OS command injection by attackers connected to the router's LAN.

5

Is there a workaround for CVE-2026-0403?

Currently, the best workaround for CVE-2026-0403 is to limit access to the router's LAN and apply all recommended security best practices.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203