CVSS 4.0
6.1 mediumCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:AmberCVE-2026-0405
Medium (6.1) in netgear. EPSS 0.4% chance of exploitation in the next 30 days.
An authentication bypass vulnerability in NETGEAR Orbi devices allows
users connected to the local network to access the router web interface
as an admin.
Severity
CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netgear:cbr750_firmware
- netgear:nbr750_firmware
- netgear:rbe370_firmware
- netgear:rbe371_firmware
- netgear:rbe372_firmware
- netgear:rbe373_firmware
- netgear:rbe374_firmware
- netgear:rbe770_firmware
- netgear:rbe771_firmware
- netgear:rbe772_firmware
- netgear:rbe773_firmware
- netgear:rbe970_firmware
- netgear:rbe971_firmware
- netgear:rbr750_firmware
- netgear:rbr840_firmware
- netgear:rbr850_firmware
- netgear:rbr860_firmware
- netgear:rbre950_firmware
- netgear:rbre960_firmware
- netgear:rbs750_firmware
- netgear:rbs840_firmware
- netgear:rbs850_firmware
- netgear:rbs860_firmware
- netgear:rbse950_firmware
- netgear:rbse960_firmware