Insufficient input validation in NETGEAR Orbi routers

Successful exploitation of CVE-2026-0404 allows an attacker authenticated over WiFi or on the local area network (LAN) to execute arbitrary operating system commands on the vulnerable NETGEAR Orbi Router. This could lead to a complete takeover of the router, enabling the attacker to modify configurations, steal sensitive data (such as network credentials and user data), and potentially pivot to other devices on the network. The impact is particularly severe because routers often serve as the gateway to the internet and control access to internal network resources. While DHCPv6 is disabled by default, environments where it is enabled are at significant risk.

Home and small business users who rely on NETGEAR Orbi Routers are at risk, particularly those who have enabled DHCPv6. Shared hosting environments utilizing Orbi routers for network management are also vulnerable. Legacy configurations with outdated firmware are especially susceptible.

• netgear: Examine router logs for unusual DHCPv6 client requests or error messages. • linux / server: journalctl -u dhcpv6 -f to monitor DHCPv6 daemon logs for suspicious activity. • generic web: Use curl -v to test DHCPv6 endpoint responses for unexpected behavior or error codes.

1. 2026-01-13Disclosure

   disclosure

1. Reserviert2025-12-03
2. Veröffentlicht2026-01-13
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-0404 is to upgrade NETGEAR Orbi Routers to firmware version v7.2.8.5 or later. If an immediate upgrade is not possible due to compatibility issues or testing requirements, disabling the DHCPv6 functionality on the router can significantly reduce the attack surface. This can be done through the router's web interface. Monitor network traffic for unusual activity originating from or destined to the router. Consider implementing network segmentation to limit the potential blast radius of a successful attack.