CVE-2026-0404 is an identified vulnerability in the NETGEAR RBRE960 Orbi router series, categorized under CWE-20 (Improper Input Validation). The flaw resides in the DHCPv6 implementation of the device, where insufficient validation of input data allows an attacker with network adjacency and authenticated access over WiFi or LAN to perform OS command injection attacks. This means that an attacker who has already gained some level of access to the local network or WiFi can craft malicious DHCPv6 packets that the router improperly processes, leading to arbitrary command execution on the router’s operating system. The vulnerability does not require user interaction but does require the attacker to have low-level privileges (authenticated access). DHCPv6 is not enabled by default on these devices, which limits exposure; however, in environments where DHCPv6 is enabled, the risk is significant. The CVSS 4.0 base score is 4.8 (medium), reflecting the moderate impact and attack complexity. The vulnerability affects the confidentiality, integrity, and availability of the router and potentially the entire network it manages, as attackers could manipulate routing, intercept traffic, or disrupt services. No patches or exploits are currently publicly available, but the vulnerability is published and should be addressed proactively.

For European organizations, this vulnerability poses a risk primarily to network infrastructure relying on NETGEAR RBRE960 Orbi routers, especially where DHCPv6 is enabled. Successful exploitation could lead to full compromise of the router, enabling attackers to intercept, modify, or disrupt network traffic, potentially affecting sensitive data confidentiality and network availability. This is particularly critical for enterprises and public sector organizations with internal networks using IPv6 addressing and DHCPv6 services. The ability to execute OS commands on the router could allow attackers to pivot into internal networks, escalate privileges, or launch further attacks. Given the medium CVSS score and requirement for authenticated network access, the threat is moderate but should not be underestimated in environments with lax WiFi or LAN access controls. The lack of known exploits reduces immediate risk but does not eliminate the need for mitigation.

European organizations should first verify whether DHCPv6 is enabled on their NETGEAR RBRE960 devices and disable it if not required, as it is off by default. Network administrators should enforce strong WiFi and LAN authentication mechanisms to prevent unauthorized access, including WPA3 where possible and network segmentation to limit attacker movement. Monitoring network traffic for unusual DHCPv6 activity can help detect exploitation attempts. Organizations should stay alert for official patches or firmware updates from NETGEAR and apply them promptly once released. Additionally, implementing strict access control lists (ACLs) on internal networks to restrict DHCPv6 traffic to trusted devices can reduce exposure. Regularly auditing router configurations and firmware versions will help maintain security posture. Finally, consider deploying network intrusion detection systems (NIDS) capable of identifying DHCPv6 anomalies.