CVE-2026-0403: OS Command Injection in NETGEAR Orbi routers

Successful exploitation of CVE-2026-0403 grants an attacker the ability to execute arbitrary OS commands on the vulnerable NETGEAR Orbi router. This represents a severe security risk, potentially allowing an attacker to gain complete control over the device. An attacker could modify router configurations, intercept network traffic, install malware, or use the router as a pivot point to compromise other devices on the LAN. The blast radius extends to all devices connected to the affected Orbi router’s network, making it a critical concern for home and small business users.

1. Reserved2025-12-03
2. Published2026-01-13
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0403 is to immediately upgrade your NETGEAR Orbi router to version v9.10.0.2 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider segmenting the LAN to limit the attacker's potential reach. Implement strict firewall rules to restrict access to the router's management interface from untrusted networks. Monitor router logs for suspicious activity, particularly command execution attempts. While a WAF is unlikely to be effective here, network segmentation and access control are crucial.