{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-0403", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "state": "PUBLISHED", "assignerShortName": "NETGEAR", "dateReserved": "2025-12-03T04:16:02.333Z", "datePublished": "2026-01-13T16:00:25.831Z", "dateUpdated": "2026-02-26T15:04:45.176Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "RBR750", "vendor": "NETGEAR", "versions": [ { "lessThanOrEqual": "4.6.14.3", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBS750", "vendor": "NETGEAR", "versions": [ { "lessThanOrEqual": "4.6.14.3", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBRE960", "vendor": "NETGEAR", "versions": [ { "lessThan": "v7.2.7.15", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBSE960", "vendor": "NETGEAR", "versions": [ { "lessThan": "v7.2.7.15", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBR850", "vendor": "NETGEAR", "versions": [ { "lessThan": "V7.2.8.5", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBS850", "vendor": "NETGEAR", "versions": [ { "lessThan": "V7.2.8.5", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBE971", "vendor": "NETGEAR", "versions": [ { "lessThan": "v9.10.0.2", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBE970", "vendor": "NETGEAR", "versions": [ { "lessThan": "v9.10.0.2", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBR860", "vendor": "NETGEAR", "versions": [ { "lessThan": "v7.2.8.5", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "RBS860", "vendor": "NETGEAR", "versions": [ { "lessThan": "v7.2.8.5", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbr750:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.6.14.3", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbs750:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.6.14.3", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbre960:*:*:*:*:*:*:*:*", "versionEndExcluding": "v7.2.7.15", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbse960:*:*:*:*:*:*:*:*", "versionEndExcluding": "v7.2.7.15", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbr850:*:*:*:*:*:*:*:*", "versionEndExcluding": "v7.2.8.5", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbs850:*:*:*:*:*:*:*:*", "versionEndExcluding": "v7.2.8.5", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbe971:*:*:*:*:*:*:*:*", "versionEndExcluding": "v9.10.0.2", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbe970:*:*:*:*:*:*:*:*", "versionEndExcluding": "v9.10.0.2", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbr860:*:*:*:*:*:*:*:*", "versionEndExcluding": "v7.2.8.5", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:netgear:rbs860:*:*:*:*:*:*:*:*", "versionEndExcluding": "v7.2.8.5", "versionStartIncluding": "0", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "OR" } ], "credits": [ { "lang": "en", "type": "finder", "value": "fxc233" } ], "datePublic": "2026-01-13T16:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

An insufficient input validation vulnerability in NETGEAR Orbi routers \nallows attackers connected to the router's LAN to execute OS command \ninjections. 

" } ], "value": "An insufficient input validation vulnerability in NETGEAR Orbi routers \nallows attackers connected to the router's LAN to execute OS command \ninjections." } ], "impacts": [ { "capecId": "CAPEC-88", "descriptions": [ { "lang": "en", "value": "CAPEC-88 OS Command Injection" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 1.1, "baseSeverity": "LOW", "exploitMaturity": "UNREPORTED", "privilegesRequired": "HIGH", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-01-13T16:20:30.263Z" }, "references": [ { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbr750" }, { "tags": [ "patch", "product" ], "url": "https://www.netgear.com/support/product/rbs750" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbre960" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbse960" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbr850" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbs850" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbe971" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbe970" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbr860" }, { "tags": [ "product", "patch" ], "url": "https://www.netgear.com/support/product/rbs860" }, { "tags": [ "vendor-advisory" ], "url": "https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Devices with automatic updates enabled may already have this\npatch applied. If not, please check the firmware version and update it to the\nlatest.

\n\n

Fixed in:

RBE971 firmware 9.10.0.2 or later
RBE970 firmware 9.10.0.2 or later
RBR750 firmware 7.2.8.5 or later
RBR850 firmware 7.2.8.5 or later
RBR860 firmware 7.2.8.5 or later
RBS750 firmware 7.2.8.5 or later
RBS850 firmware 7.2.8.5 or later
RBS860 firmware 7.2.8.5 or later
RBRE960 firmware 7.2.7.15 or later
RBSE960 firmware 7.2.7.15 or later

" } ], "value": "Devices with automatic updates enabled may already have this\npatch applied. If not, please check the firmware version and update it to the\nlatest.\n\n\n\nFixed in:\n\nRBE971 firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe971 \nRBE970 firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe970 \nRBR750 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr750 \nRBR850 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr850 \nRBR860 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr860 \nRBS750 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs750 \nRBS850 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs850 \nRBS860 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs860 \nRBRE960 firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbre960 \nRBSE960 firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbse960" } ], "source": { "discovery": "EXTERNAL" }, "title": "Insufficient input validation in NETGEAR Orbi routers", "x_generator": { "engine": "Vulnogram 0.5.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2026-0403", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T04:57:20.518970Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:45.176Z" } } ] } }