---
id: CVE-2026-0403
title: Insufficient input validation in NETGEAR Orbi routers
summary: "An insufficient input validation vulnerability in NETGEAR Orbi routers \nallows attackers connected to the router's LAN\_to execute OS command \ninjections."
severity: low
cvss: 1.1
cvssVector: >-
  CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
cvssSource: cna
cwe:
  - CWE-20
vendor: NETGEAR
product: RBR750
affected:
  - RBR750 <= 4.6.14.3
  - RBS750 <= 4.6.14.3
  - RBRE960 < v7.2.7.15
  - RBSE960 < v7.2.7.15
  - RBR850 < V7.2.8.5
  - RBS850 < V7.2.8.5
  - RBE971 < v9.10.0.2
  - RBE970 < v9.10.0.2
  - RBR860 < v7.2.8.5
  - RBS860 < v7.2.8.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-01-14T04:57:20.518970Z'
published: '2026-01-13'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:16:52.276Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-0403'
references:
  - url: 'https://www.netgear.com/support/product/rbr750'
  - url: 'https://www.netgear.com/support/product/rbs750'
  - url: 'https://www.netgear.com/support/product/rbre960'
  - url: 'https://www.netgear.com/support/product/rbse960'
  - url: 'https://www.netgear.com/support/product/rbr850'
  - url: 'https://www.netgear.com/support/product/rbs850'
  - url: 'https://www.netgear.com/support/product/rbe971'
  - url: 'https://www.netgear.com/support/product/rbe970'
  - url: 'https://www.netgear.com/support/product/rbr860'
  - url: 'https://www.netgear.com/support/product/rbs860'
  - url: 'https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory'
tags:
  - cve.org
epss: 0.0033
epssPercentile: 0.26323
ingestedAt: '2026-11-05T20:33:06.651Z'
---

## Overview

An insufficient input validation vulnerability in NETGEAR Orbi routers 
allows attackers connected to the router's LAN to execute OS command 
injections.

## Affected

- `RBR750 <= 4.6.14.3`
- `RBS750 <= 4.6.14.3`
- `RBRE960 < v7.2.7.15`
- `RBSE960 < v7.2.7.15`
- `RBR850 < V7.2.8.5`
- `RBS850 < V7.2.8.5`
- `RBE971 < v9.10.0.2`
- `RBE970 < v9.10.0.2`
- `RBR860 < v7.2.8.5`
- `RBS860 < v7.2.8.5`

## Remediation

Devices with automatic updates enabled may already have this
patch applied. If not, please check the firmware version and update it to the
latest.



Fixed in:

RBE971  firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe971 
RBE970  firmware 9.10.0.2 or later https://www.netgear.com/support/product/rbe970 
RBR750  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr750 
RBR850  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr850 
RBR860  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbr860 
RBS750  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs750 
RBS850  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs850 
RBS860  firmware 7.2.8.5 or later https://www.netgear.com/support/product/rbs860 
RBRE960  firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbre960 
RBSE960  firmware 7.2.7.15 or later https://www.netgear.com/support/product/rbse960