CVE-2026-123178

MediumCVSS 4.5/10Last modified Nov 11, 2026

Description

An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected device.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
NETGEAR	RBR350	< v4.4.3.4
NETGEAR	RBS350	< v4.4.3.4

References

Timeline

Published: Nov 10, 2026
Last modified: Nov 11, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1231795.5An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 all CVE-2026-123187.3Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231808.8A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi ne CVE-2026-1231815.5A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with adminis CVE-2026-1231835.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCo CVE-2026-1231848.1An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a projec CVE-2026-123196.5Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231968.1Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link host CVE-2026-1231975.3WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted st CVE-2026-1231989.8LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated CVE-2026-1231995.5eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded CVE-2026-12326.8A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Under certain condition