CVE-2026-0404: Insufficient input validation in NETGEAR Orbi routers
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.
Affected Software
Remediation
Information
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0404?
CVE-2026-0404 is considered a high-severity vulnerability due to the potential for OS command injections.
How do I fix CVE-2026-0404?
To fix CVE-2026-0404, ensure that DHCPv6 is disabled on NETGEAR Orbi routers and apply any firmware updates provided by NETGEAR.
Who is affected by CVE-2026-0404?
CVE-2026-0404 affects users of NETGEAR Orbi routers with DHCPv6 functionality enabled.
What type of attacks can be performed using CVE-2026-0404?
Using CVE-2026-0404, authenticated attackers on the same network can execute OS command injections on the vulnerable router.
Is DHCPv6 enabled by default in NETGEAR Orbi devices concerning CVE-2026-0404?
No, DHCPv6 is not enabled by default in NETGEAR Orbi devices, which reduces the immediate risk for many users.