Insufficient Input Validation OS Command Injection in NETGEAR Orbi Router (LAN)
CVE-2026-0403 Published on January 13, 2026

Insufficient input validation in NETGEAR Orbi routers
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.

Vendor Advisory NVD

Weakness Type

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Products Associated with CVE-2026-0403

Want to know whenever a new CVE is published for Netgear products? stack.watch will email you.

Netgear Rbr750

Netgear Rbs750

Netgear Rbre960

Netgear Rbse960

Netgear Rbr850

Netgear Rbs850

Netgear Rbe971

Netgear Rbe970

Netgear Rbr860

Netgear Rbs860

Affected Versions

NETGEAR RBR750:

Before and including 4.6.14.3 is affected.

NETGEAR RBS750:

Before and including 4.6.14.3 is affected.

NETGEAR RBRE960:

Before v7.2.7.15 is affected.

NETGEAR RBSE960:

Before v7.2.7.15 is affected.

NETGEAR RBR850:

Before V7.2.8.5 is affected.

NETGEAR RBS850:

Before V7.2.8.5 is affected.

NETGEAR RBE971:

Before v9.10.0.2 is affected.

NETGEAR RBE970:

Before v9.10.0.2 is affected.

NETGEAR RBR860:

Before v7.2.8.5 is affected.

NETGEAR RBS860:

Before v7.2.8.5 is affected.

Exploit Probability

EPSS

0.08%

Percentile

23.69%