CVE-2026-0405: Authentication Bypass in NETGEAR Orbi Devices

Successful exploitation of CVE-2026-0405 grants an attacker complete administrative control over the affected NETGEAR Orbi device. This includes the ability to modify network settings, access sensitive data stored on the router, and potentially compromise connected devices on the local network. An attacker could, for example, redirect traffic through a malicious server, install malware on connected devices, or steal user credentials. The blast radius extends to all devices connected to the compromised Orbi network.

1. Reserved2025-12-03
2. Published2026-01-13
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0405 is to immediately upgrade affected NETGEAR Orbi devices to firmware version v12.1.3.11 or later. If upgrading is not immediately feasible due to compatibility concerns or network downtime requirements, consider segmenting the network to isolate the Orbi device from critical assets. While a direct workaround isn't available, regularly reviewing connected devices and monitoring network traffic for unusual activity can help detect potential compromise. After upgrading, confirm the fix by attempting to access the router’s web interface from a local network device without administrative credentials; access should be denied.