EUVD-2026-44327
GHSA-9pqr-xmfw-fwj3
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only vector (AV:A), no auth or interaction needed, pure availability crash with no confidentiality or integrity impact.
Primary rating from Vendor (NETGEAR).
CVSS VectorVendor: NETGEAR
Lifecycle Timeline
1DescriptionCVE.org
A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable.
AnalysisAI
Stack-based buffer overflow in multiple NETGEAR Orbi mesh WiFi models (RBR860, RBRE950/960, RBE970/971, RBS860, RBSE950/960) enables an unauthenticated adjacent-network attacker to crash or force a restart of the affected device, causing a loss of network connectivity. The root cause is CWE-121 (stack-based buffer overflow), meaning a crafted network payload can overwrite stack memory and destabilize the device process. The CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exploit exists, elevating practical risk despite the moderate base score of 5.7.
Technical ContextAI
The vulnerability is classified as CWE-121, a stack-based buffer overflow, occurring within NETGEAR's Orbi mesh networking firmware. Orbi devices are Wi-Fi mesh systems built around a router base unit (RBR/RBE) and satellite extenders (RBS/RBSE), communicating over both wired and wireless backhaul. The affected CPE strings (cpe:2.3:a:netgear:rbr860, rbre950, rbre960, rbe970, rbe971, rbs860, rbse950, rbse960) span the Orbi 860 and 950/960/970/971 series. A stack-based buffer overflow in this context likely occurs in a network-facing service - such as an HTTP management daemon, UPnP handler, or proprietary Orbi backhaul protocol - where an oversized or malformed input is copied into a fixed-size stack buffer without length validation, corrupting the stack frame and causing an unhandled exception that crashes the device process or triggers a watchdog-initiated reboot.
RemediationAI
The primary remediation is to apply the firmware update issued by NETGEAR for each affected Orbi model. Navigate to the relevant product support page for your specific model (e.g., https://www.netgear.com/support/product/rbr860/ for the RBR860) to download and install the latest firmware. The exact patched firmware version numbers are not specified in the available data; consult the support page directly to confirm the minimum safe version. Firmware updates on Orbi devices can typically be applied through the Orbi web management interface (routerlogin.net) or the NETGEAR Orbi mobile app. As a compensating control while patching is pending, restrict Wi-Fi network access to trusted devices only by enabling WPA3 or WPA2-AES with a strong passphrase and disabling guest network access, thereby preventing untrusted adjacent-network actors from reaching the vulnerable service. Disabling UPnP on the Orbi management interface may also reduce the exposed attack surface if the vulnerability resides in that service, though this has not been confirmed. Note that firmware updates may cause a brief service interruption during the reboot cycle.
Denial-of-service via out-of-bounds write in NETGEAR Orbi mesh router and satellite firmware allows unauthenticated, adj
Insufficient input validation across multiple NETGEAR Orbi mesh router models (RBR/RBS/RBE series) permits authenticated
Stack-based buffer overflow in NETGEAR Orbi mesh router firmware (RBE, RBR, RBS series) enables authenticated administra
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today