CVE-2026-0405

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04068.0An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command CVE-2026-04078.0An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or CVE-2026-04088.0A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and re CVE-2026-04096.4A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet CVE-2026-04104.5Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorized changes to router CVE-2026-04118.0An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to CVE-2026-04124.5Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows adminis CVE-2026-04134.5A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connec CVE-2026-04144.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04154.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-04164.5An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated administrator with local n CVE-2026-04174.5Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected to the local network