Contournement d'authentification dans les appareils NETGEAR Orbi

Successful exploitation of CVE-2026-0405 grants an attacker complete administrative control over the affected NETGEAR Orbi device. This includes the ability to modify network settings, access sensitive data stored on the router, and potentially compromise connected devices on the local network. An attacker could, for example, redirect traffic through a malicious server, install malware on connected devices, or steal user credentials. The blast radius extends to all devices connected to the compromised Orbi network.

Home users and small businesses relying on NETGEAR Orbi devices for their network infrastructure are at risk. This includes those who have not yet updated their devices or are using older, unsupported firmware versions. Shared hosting environments utilizing Orbi devices for network management could also be affected.

• netgear / router:

# Check firmware version
/usr/bin/nvram get version

• netgear / router:

# Check for unusual login attempts in system logs
/usr/bin/grep -i 'login: admin' /var/log/dmesg

1. 2026-01-13Disclosure

   disclosure

1. Réservé2025-12-03
2. Publiée2026-01-13
3. Modifiée2026-02-26
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-0405 is to immediately upgrade affected NETGEAR Orbi devices to firmware version v12.1.3.11 or later. If upgrading is not immediately feasible due to compatibility concerns or network downtime requirements, consider segmenting the network to isolate the Orbi device from critical assets. While a direct workaround isn't available, regularly reviewing connected devices and monitoring network traffic for unusual activity can help detect potential compromise. After upgrading, confirm the fix by attempting to access the router’s web interface from a local network device without administrative credentials; access should be denied.