CVE-2026-0403
Published: 13 January 2026
Summary
CVE-2026-0403 is a high-severity Improper Input Validation (CWE-20) vulnerability in Netgear Rbe971 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the insufficient input validation (CWE-20) vulnerability by requiring validation of all inputs to prevent OS command injection from LAN-connected attackers.
Mandates timely flaw remediation through firmware patches as specified in NETGEAR's January 2026 Security Advisory for affected Orbi models.
Ensures monitoring and dissemination of security advisories like NETGEAR's for CVE-2026-0403 to enable proactive patching and mitigation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct OS command injection on network device enables arbitrary CLI command execution (T1059.008).
NVD Description
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.
Deeper analysisAI
CVE-2026-0403 is an insufficient input validation vulnerability (CWE-20) present in NETGEAR Orbi routers, enabling attackers connected to the router's LAN to execute OS command injections. The vulnerability affects specific Orbi models, including RBE970, RBE971, RBR750, and RBR850. It carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-13T16:16:10.150.
Attackers with adjacent network access (AV:A) and low privileges (PR:L), such as local LAN users, can exploit the issue with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows OS command injection, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U) of the router.
NETGEAR's January 2026 Security Advisory at https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory details mitigation steps, including available patches. Security practitioners should review the advisory alongside product support pages for the affected models, such as https://www.netgear.com/support/product/rbe970, https://www.netgear.com/support/product/rbe971, https://www.netgear.com/support/product/rbr750, and https://www.netgear.com/support/product/rbr850, to apply firmware updates or other recommended remediations.
Details
- CWE(s)