CVE-2026-0405
Unknown
Unknown - Not Provided
Authentication Bypass in NETGEAR Orbi Allows Admin Access
Publication date: 2026-01-13
Last updated on: 2026-02-12
Assigner: Netgear, Inc.
Description
Description
An authentication bypass vulnerability in NETGEAR Orbi devices allows
users connected to the local network to access the router web interface
as an admin.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netgear | cbr750_firmware | to 4.6.14.8 (exc) |
| netgear | nbr750_firmware | to 4.6.15.14 (exc) |
| netgear | rbe370_firmware | to 12.1.3.11 (exc) |
| netgear | rbe371_firmware | to 12.1.3.11 (exc) |
| netgear | rbe372_firmware | to 12.1.3.11 (exc) |
| netgear | rbe373_firmware | to 12.1.3.11 (exc) |
| netgear | rbe374_firmware | to 12.1.3.11 (exc) |
| netgear | rbe770_firmware | to 10.5.20.7 (exc) |
| netgear | rbe771_firmware | to 10.5.20.7 (exc) |
| netgear | rbe772_firmware | to 10.5.20.7 (exc) |
| netgear | rbe773_firmware | to 10.5.20.7 (exc) |
| netgear | rbe970_firmware | to 9.13.2.1 (exc) |
| netgear | rbe971_firmware | to 9.13.2.1 (exc) |
| netgear | rbr750_firmware | to 7.2.8.2 (exc) |
| netgear | rbr840_firmware | to 7.2.8.2 (exc) |
| netgear | rbr850_firmware | to 7.2.8.2 (exc) |
| netgear | rbr860_firmware | to 7.2.8.2 (exc) |
| netgear | rbs750_firmware | to 7.2.8.2 (exc) |
| netgear | rbs840_firmware | to 7.2.8.2 (exc) |
| netgear | rbs850_firmware | to 7.2.8.2 (exc) |
| netgear | rbs860_firmware | to 7.2.8.2 (exc) |
| netgear | rbre950_firmware | to 7.2.8.2 (exc) |
| netgear | rbre960_firmware | to 7.2.8.2 (exc) |
| netgear | rbse950_firmware | to 7.2.8.2 (exc) |
| netgear | rbse960_firmware | to 7.2.8.2 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
