CVE-2026-0405

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
NETGEARRBE970< v9.13.2.1
NETGEARRBE971< v9.13.2.1
NETGEARCBR750< V4.6.14.8
NETGEARNBR750< V4.6.15.14
NETGEARRBE770< v10.5.20.7
NETGEARRBE771< v10.5.20.7
NETGEARRBE772< v10.5.20.7
NETGEARRBE773< v10.5.20.7
NETGEARRBR750< v7.2.8.2
NETGEARRBS750< v7.2.8.2
NETGEARRBR840< v7.2.8.2
NETGEARRBS840< v7.2.8.2
NETGEARRBR850< v7.2.8.2
NETGEARRBS850< v7.2.8.2
NETGEARRBR860< v7.2.8.2
NETGEARRBS860< v7.2.8.2
NETGEARRBRE950< v7.2.8.2
NETGEARRBSE950< v7.2.8.2
NETGEARRBRE960< v7.2.8.2
NETGEARRBSE960< v7.2.8.2
NETGEARRBE370< v12.1.3.11
NETGEARRBE371< v12.1.3.11
NETGEARRBE372< v12.1.3.11
NETGEARRBE373< v12.1.3.11
NETGEARRBE374< v12.1.3.11

References

Timeline

Published
Jan 13, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-04068.0An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS commandCVE-2026-04078.0An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication orCVE-2026-04088.0A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and reCVE-2026-04096.4A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet CVE-2026-04104.5Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorized changes to router CVE-2026-04118.0An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to CVE-2026-04124.5Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows adminisCVE-2026-04134.5A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connecCVE-2026-04144.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04154.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04164.5An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local nCVE-2026-04174.5Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network
CVE-2026-0405: High severity, CVSS 7.8 | Vulnix