CVE-2026-0405

Tuesday, January 13, 2026

6.1

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Summary

An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.

Affected Software

Vendor	Product	Version Range	Status
NETGEAR	RBE970	`0 < v9.13.2.1`	affected
NETGEAR	RBE971	`0 < v9.13.2.1`	affected
NETGEAR	CBR750	`0 < V4.6.14.8`	affected
NETGEAR	NBR750	`0 < V4.6.15.14`	affected
NETGEAR	RBE770	`0 < v10.5.20.7`	affected
NETGEAR	RBE771	`0 < v10.5.20.7`	affected
NETGEAR	RBE772	`0 < v10.5.20.7`	affected
NETGEAR	RBE773	`0 < v10.5.20.7`	affected
NETGEAR	RBR750	`0 < v7.2.8.2`	affected
NETGEAR	RBS750	`0 < v7.2.8.2`	affected
NETGEAR	RBR840	`0 < v7.2.8.2`	affected
NETGEAR	RBS840	`0 < v7.2.8.2`	affected
NETGEAR	RBR850	`0 < v7.2.8.2`	affected
NETGEAR	RBS850	`0 < v7.2.8.2`	affected
NETGEAR	RBR860	`0 < v7.2.8.2`	affected
NETGEAR	RBS860	`0 < v7.2.8.2`	affected
NETGEAR	RBRE950	`0 < v7.2.8.2`	affected
NETGEAR	RBSE950	`0 < v7.2.8.2`	affected
NETGEAR	RBRE960	`0 < v7.2.8.2`	affected
NETGEAR	RBSE960	`0 < v7.2.8.2`	affected
NETGEAR	RBE370	`0 < v12.1.3.11`	affected
NETGEAR	RBE371	`0 < v12.1.3.11`	affected
NETGEAR	RBE372	`0 < v12.1.3.11`	affected
NETGEAR	RBE373	`0 < v12.1.3.11`	affected
NETGEAR	RBE374	`0 < v12.1.3.11`	affected

Weaknesses

CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.