- 1.1LowCVSS base score
- 0.33%Exploitation in 30 daysEPSS · top 74% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.
Timeline
ID reserved
By NETGEAR
- 41 days later
· 41 days later
Published
- 10 months later
· 10 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NETGEARCNA (assigner) | 4.0 | Low1.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber |
| NVDNVD · Analyzed | 4.0 | Low1.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 1.1.
Affected products
- affected ≤ 4.6.14.3
- affected ≤ 4.6.14.3
- affected < v7.2.7.15
- affected < v7.2.7.15
- affected < V7.2.8.5
- affected < V7.2.8.5
- affected < v9.10.0.2
- affected < v9.10.0.2
- affected < v7.2.8.5
- affected < v7.2.8.5
What to do
Solution: Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in: RBE971 firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe971 RBE970 firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe970 RBR750 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr750 RBR850 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr850 RBR860 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr860 RBS750 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs750 RBS850 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs850 RBS860 firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs860 RBRE960 firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbre960 RBSE960 firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbse960
References
References11
- https://www.netgear.com/support/product/rbr750 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbs750 (opens in a new tab)patchproduct
- https://www.netgear.com/support/product/rbre960 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbse960 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbr850 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbs850 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbe971 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbe970 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbr860 (opens in a new tab)productpatch
- https://www.netgear.com/support/product/rbs860 (opens in a new tab)productpatch
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory (opens in a new tab)vendor-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-2232 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-0403)Record last updated .