CVE-2026-0404

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04057.8An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interfa CVE-2026-04068.0An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command CVE-2026-04078.0An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or CVE-2026-04088.0A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and re CVE-2026-04096.4A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet CVE-2026-04104.5Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorized changes to router CVE-2026-04118.0An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to CVE-2026-04124.5Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows adminis CVE-2026-04134.5A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connec CVE-2026-04144.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04154.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04164.5An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local n