CVE-2026-0404

High · 8.0

CVSS

8.0

EPSS

1.1%

Published

Jan 13, 2026

CISA due date

—

The record

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

Affected packages

Ecosystem	Package	Introduced	Fixed