CVE-2026-0404
📋 TL;DR
An insufficient input validation vulnerability in NETGEAR Orbi routers' DHCPv6 functionality allows authenticated attackers on the same network (WiFi or LAN) to execute arbitrary OS commands on the router. This affects NETGEAR Orbi RBR750, RBR840, RBR850, and RBR860 models. DHCPv6 is disabled by default, reducing the attack surface.
💻 Affected Systems
- NETGEAR Orbi RBR750
- NETGEAR Orbi RBR840
- NETGEAR Orbi RBR850
- NETGEAR Orbi RBR860
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to intercept all network traffic, install persistent backdoors, pivot to other devices, or brick the router.
Likely Case
Router compromise leading to network traffic interception, DNS hijacking, or credential theft from connected devices.
If Mitigated
No impact if DHCPv6 is disabled and proper network segmentation is in place.
🎯 Exploit Status
Requires attacker to be authenticated on the network and have DHCPv6 enabled. No public exploit code available as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific firmware versions
Vendor Advisory: https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory
Restart Required: Yes
Instructions:
1. Log into Orbi web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install latest firmware. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable DHCPv6
allDisable DHCPv6 functionality to eliminate the attack vector
Log into Orbi web interface > Advanced > Setup > IPv6 > Set IPv6 Connection Type to 'Disabled'
Network Segmentation
allIsolate IoT/guest devices from trusted network segments
Configure separate VLANs for untrusted devices
Enable guest network isolation
🧯 If You Can't Patch
- Disable DHCPv6 immediately in router settings
- Implement strict network access controls and monitor for suspicious DHCPv6 traffic
🔍 How to Verify
Check if Vulnerable:
Check if DHCPv6 is enabled in router settings and firmware version is unpatchedCheck Version:
Log into Orbi web interface > Advanced > Administration > Firmware Update to view current versionVerify Fix Applied:
Verify firmware version matches patched version in vendor advisory and DHCPv6 remains disabled or updated📡 Detection & Monitoring
Log Indicators:
- Unusual DHCPv6 requests
- Suspicious command execution in router logs
- Unexpected firmware or configuration changes
Network Indicators:
- Malformed DHCPv6 packets
- Unexpected outbound connections from router
- DNS or network configuration changes
SIEM Query:
source="router_logs" AND (dhcpv6 OR command_injection OR firmware_change)🔗 References
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory
- https://www.netgear.com/support/product/rbr750
- https://www.netgear.com/support/product/rbr840
- https://www.netgear.com/support/product/rbr850
- https://www.netgear.com/support/product/rbr860
- https://www.netgear.com/support/product/rbre950
- https://www.netgear.com/support/product/rbre960
- https://www.netgear.com/support/product/rbs750
- https://www.netgear.com/support/product/rbs840
- https://www.netgear.com/support/product/rbs850
- https://www.netgear.com/support/product/rbs860
- https://www.netgear.com/support/product/rbse950
- https://www.netgear.com/support/product/rbse960
