EUVD-2026-35464
GHSA-q37p-q3j4-w7g6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Orbi admin credentials
-
DeliveryConnect to adjacent local network
-
ExploitSubmit malformed admin interface input
-
ExecutionBypass input validation controls
-
ImpactModify router software or configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires two concrete prerequisites: the attacker must hold valid administrator-level credentials for the affected Orbi device (PR:H - high privileges confirmed by CVSS vector), and the attacker must be directly connected to the adjacent local network segment (AV:A - adjacent vector confirmed by CVSS). Remote exploitation over the internet is not possible given the adjacent-only attack vector. The vulnerability does not appear to require any specific non-default feature to be enabled beyond the standard Orbi administrative interface being accessible. Limiting factors include the LAN adjacency requirement (eliminates internet-based mass exploitation), the need for admin credentials (eliminates unauthenticated access paths), and the integrity-only impact scope (no data exfiltration or denial-of-service capability). These factors collectively restrict exploitation to insiders, attackers who have already compromised admin credentials, or those with physical/Wi-Fi access to the network segment. |
| Impact | The real-world risk is constrained by two significant limiting factors embedded in the CVSS 4.0 vector: the attacker must already hold high-privilege (administrator) credentials (PR:H) and must be positioned on the adjacent local network (AV:A). These preconditions substantially reduce the exploitable attack surface compared to remote, unauthenticated vulnerabilities. The CVSS 4.0 score of 4.3 reflects this accurately. Impact is limited to integrity (VI:H) with no confidentiality or availability impact at the base or environmental levels, meaning an attacker cannot exfiltrate data or crash devices - only tamper with router software or settings. The exploit maturity modifier E:U confirms no public exploit exists. The vulnerability is not in the CISA KEV catalog, indicating no confirmed active exploitation. The 'Authentication Bypass' tag creates a potential confusion signal: it does not mean unauthenticated access is possible - rather, it likely describes the logical authorization bypass post-authentication. For enterprise environments where Orbi mesh units are deployed and administrative credentials could be compromised (e.g., phishing, credential reuse), the integrity risk to router firmware is meaningful. For typical home users, the risk is low given the admin credential and LAN adjacency requirements. |
| Exploit ScenarioDerived | An attacker who has obtained NETGEAR Orbi administrator credentials - through credential reuse, phishing, or internal access - connects to the local network and submits crafted, insufficiently validated inputs to the Orbi administrative interface. Due to the missing input validation, the attacker can push unauthorized modifications to router firmware or runtime configuration beyond what the interface is designed to permit, potentially altering DNS settings, routing rules, or installing modified firmware components. No public exploit code exists at time of analysis, so exploitation would require independent discovery or targeted knowledge of the vulnerable input pathway. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Insufficient input validation across multiple NETGEAR Orbi mesh router models (RBR/RBS/RBE series) permits authenticated administrators on the local network to make unauthorized modifications to router software and functionality beyond their intended privilege scope. Affected are all firmware versions prior to V7.2.8.5 on most Orbi models and prior to V9.12.4.9 on the RBE97x series. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; NETGEAR self-reported and has released patched firmware addressing the flaw.
RemediationAI
The primary remediation is to upgrade firmware to the patched versions released by NETGEAR: V7.2.8.5 or later for RBR750, RBR840, RBR850, RBR860, RBRE950, RBRE960, RBS750, RBS840, RBS850, RBS860, RBSE950, and RBSE960; and V9.12.4.9 or later for the RBE97x series. Firmware updates can be applied via the Orbi web administration interface or the Orbi mobile app. NETGEAR product-specific advisory and firmware download pages include: https://www.netgear.com/support/product/rbr850/, https://www.netgear.com/support/product/rbr750/, https://www.netgear.com/support/product/rbr860/, https://www.netgear.com/support/product/rbs850/, https://www.netgear.com/support/product/rbs750/, https://www.netgear.com/support/product/rbs840/, https://www.netgear.com/support/product/rbr840/, https://www.netgear.com/support/product/rbre950/, https://www.netgear.com/support/product/rbre960/, and https://www.netgear.com/support/product/rbe970/. As a compensating control prior to patching, administrators should rotate all Orbi admin credentials and enforce unique, complex passwords to reduce the risk of credential compromise that would enable exploitation. Restricting physical and Wi-Fi access to the local network segment hosting the Orbi routers limits adjacent-network exposure but does not eliminate risk from insider threats.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices are NETGEAR's Orbi mesh networking product line, spanning satellite (RBS), router (RBR), and enterprise/business-grade (RBE) models including the RBR750, RBR840, RBR850, RBR860, RBRE950, RBRE960, RBE97x, RBS750, RBS840, RBS850, and associated RBSE variants. The root cause is CWE-20 (Improper Input Validation) - the firmware's administrative interface fails to sufficiently validate or constrain inputs supplied by authenticated administrator sessions, allowing inputs that should be rejected to reach sensitive software modification pathways. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N) confirms the attack surface is the adjacent local network (LAN/Wi-Fi), that no special attack preconditions beyond admin credentials are required, and that no user interaction is needed once authenticated. Despite being tagged 'Authentication Bypass,' the vector PR:H indicates the bypass is one of authorization scope rather than authentication itself - a legitimately authenticated admin can exceed the bounds of permitted operations.
Know when Rbe97X gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Primary rating from Vendor (NETGEAR) · only source for this CVE.
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
2DescriptionCVE.org
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Code injection in NETGEAR RBE97x routers (firmware prior to V9.12.4.9) enables authenticated administrators on the local
Information disclosure in NETGEAR Orbi satellite devices (RBR350, RBR760, RBS350, RBS760, RBE97x) allows a low-privilege
Exploit-DB