CVE-2026-0404 — Insufficient input validation in NETGEAR Orbi routers
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS …
Published: 2026-01-13 · CVSS: 4.8 · CVSS 4.0
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7