CVE-2026-0404: OS Command Injection in NETGEAR Orbi Router

Successful exploitation of CVE-2026-0404 allows an attacker authenticated over WiFi or on the local area network (LAN) to execute arbitrary operating system commands on the vulnerable NETGEAR Orbi Router. This could lead to a complete takeover of the router, enabling the attacker to modify configurations, steal sensitive data (such as network credentials and user data), and potentially pivot to other devices on the network. The impact is particularly severe because routers often serve as the gateway to the internet and control access to internal network resources. While DHCPv6 is disabled by default, environments where it is enabled are at significant risk.

1. Reserved2025-12-03
2. Published2026-01-13
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0404 is to upgrade NETGEAR Orbi Routers to firmware version v7.2.8.5 or later. If an immediate upgrade is not possible due to compatibility issues or testing requirements, disabling the DHCPv6 functionality on the router can significantly reduce the attack surface. This can be done through the router's web interface. Monitor network traffic for unusual activity originating from or destined to the router. Consider implementing network segmentation to limit the potential blast radius of a successful attack.