CVE-2026-0403
OS Command Injection in NETGEAR Orbi Routers via LAN Access
Publication date: 2026-01-13
Last updated on: 2026-02-20
Assigner: Netgear, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netgear | rbe971_firmware | to 9.10.0.2 (exc) |
| netgear | rbe970_firmware | to 9.10.0.2 (exc) |
| netgear | rbr750_firmware | to 7.2.8.5 (exc) |
| netgear | rbr850_firmware | to 7.2.8.5 (exc) |
| netgear | rbr860_firmware | to 7.2.8.5 (exc) |
| netgear | rbs750_firmware | to 7.2.8.5 (exc) |
| netgear | rbs850_firmware | to 7.2.8.5 (exc) |
| netgear | rbs860_firmware | to 7.2.8.5 (exc) |
| netgear | rbre960_firmware | to 7.2.8.5 (exc) |
| netgear | rbse960_firmware | to 7.2.8.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an insufficient input validation flaw in NETGEAR Orbi routers that allows attackers connected to the router's local area network (LAN) to execute operating system (OS) command injections. [4]
How can this vulnerability impact me? :
An attacker on the same LAN as the affected NETGEAR Orbi router could exploit this vulnerability to execute arbitrary OS commands on the router, potentially compromising the device's security and functionality. However, the severity is rated as LOW. [4]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your NETGEAR Orbi router is running the latest firmware version. If automatic updates are not enabled, manually verify your firmware version and update to the fixed versions or later as listed: RBE971 firmware version 9.10.0.2 or later, RBE970 firmware version 9.10.0.2 or later, RBR750 firmware version 7.2.8.5 or later, RBR850 firmware version 7.2.8.5 or later, RBR860 firmware version 7.2.8.5 or later, RBS750 firmware version 7.2.8.5 or later, RBS850 firmware version 7.2.8.5 or later, RBS860 firmware version 7.2.8.5 or later, RBRE960 firmware version 7.2.7.15 or later, and RBSE960 firmware version 7.2.7.15 or later. Applying these updates promptly will prevent exploitation of the OS command injection vulnerability. [4]