VULNERABILITY INTELLIGENCE

CVE-2026-0404

CVSS score8 HIGH
EPSS probability1.06%
CISA KEVNot currently listed
Published2026-01-13
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

Weakness classification

  • a2826606-91e7-4eb6-899e-8484bd4575d5: CWE-20
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references