{"id":"CVE-2026-0403","title":"Insufficient input validation in NETGEAR Orbi routers","summary":"An insufficient input validation vulnerability in NETGEAR Orbi routers \nallows attackers connected to the router's LAN to execute OS command \ninjections.","severity":"low","cvss":1.1,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","cvssSource":"cna","cwe":["CWE-20"],"vendor":"NETGEAR","product":"RBR750","affected":["RBR750 <= 4.6.14.3","RBS750 <= 4.6.14.3","RBRE960 < v7.2.7.15","RBSE960 < v7.2.7.15","RBR850 < V7.2.8.5","RBS850 < V7.2.8.5","RBE971 < v9.10.0.2","RBE970 < v9.10.0.2","RBR860 < v7.2.8.5","RBS860 < v7.2.8.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-01-14T04:57:20.518970Z"},"published":"2026-01-13","updated":"2026-11-04","sourceUpdated":"2026-11-04T00:16:52.276Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-0403","references":[{"url":"https://www.netgear.com/support/product/rbr750"},{"url":"https://www.netgear.com/support/product/rbs750"},{"url":"https://www.netgear.com/support/product/rbre960"},{"url":"https://www.netgear.com/support/product/rbse960"},{"url":"https://www.netgear.com/support/product/rbr850"},{"url":"https://www.netgear.com/support/product/rbs850"},{"url":"https://www.netgear.com/support/product/rbe971"},{"url":"https://www.netgear.com/support/product/rbe970"},{"url":"https://www.netgear.com/support/product/rbr860"},{"url":"https://www.netgear.com/support/product/rbs860"},{"url":"https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory"}],"tags":["cve.org"],"epss":0.0033,"epssPercentile":0.26323,"ingestedAt":"2026-11-05T20:33:06.651Z","slug":"CVE-2026-0403","body":"## Overview\n\nAn insufficient input validation vulnerability in NETGEAR Orbi routers \nallows attackers connected to the router's LAN to execute OS command \ninjections.\n\n## Affected\n\n- `RBR750 <= 4.6.14.3`\n- `RBS750 <= 4.6.14.3`\n- `RBRE960 < v7.2.7.15`\n- `RBSE960 < v7.2.7.15`\n- `RBR850 < V7.2.8.5`\n- `RBS850 < V7.2.8.5`\n- `RBE971 < v9.10.0.2`\n- `RBE970 < v9.10.0.2`\n- `RBR860 < v7.2.8.5`\n- `RBS860 < v7.2.8.5`\n\n## Remediation\n\nDevices with automatic updates enabled may already have this\npatch applied. If not, please check the firmware version and update it to the\nlatest.\n\n\n\nFixed in:\n\nRBE971  firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe971 \nRBE970  firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe970 \nRBR750  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr750 \nRBR850  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr850 \nRBR860  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr860 \nRBS750  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs750 \nRBS850  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs850 \nRBS860  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs860 \nRBRE960  firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbre960 \nRBSE960  firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbse960","depth":"sunlit","depthScore":6,"depthScoreParts":{"impact":6.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}