CVE-2026-0406
Published: 13 January 2026
Summary
CVE-2026-0406 is a high-severity Improper Input Validation (CWE-20) vulnerability in Netgear Xr1000V2 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates input validation to prevent OS command injection from insufficiently validated LAN inputs in the router.
Requires timely flaw remediation, such as applying NETGEAR patches, to eliminate the command injection vulnerability.
Enforces restrictions on input types and quantities to limit opportunities for command injection payloads from LAN attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection on LAN-accessible router directly enables arbitrary command execution via network device CLI and exploitation of its remote services.
NVD Description
An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command injections.
Deeper analysisAI
CVE-2026-0406 is an insufficient input validation vulnerability (CWE-20) in the NETGEAR XR1000v2 router. Published on 2026-01-13T16:16:10.690, it carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue stems from inadequate validation of inputs, enabling OS command injection when attackers are connected to the router's LAN.
Attackers with adjacent network access, such as those on the same LAN, can exploit this vulnerability with low complexity and low privileges required, without needing user interaction. Successful exploitation allows execution of arbitrary OS commands on the router, potentially granting high-impact unauthorized access to confidential data, modification of system integrity, and disruption of availability.
NETGEAR has published a security advisory detailing mitigation steps, available at https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory. Additional product support information is provided at https://www.netgear.com/support/product/xr1000v2.
Details
- CWE(s)