Description
An insufficient input validation vulnerability in NETGEAR Orbi devices'
DHCPv6 functionality allows network adjacent attackers authenticated
over WiFi or on LAN to execute OS command injections on the router.
DHCPv6 is not enabled by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NETGEAR | RBRE960 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBSE960 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBR850 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBS850 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBR860 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBS860 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBRE950 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBSE950 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBR750 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBS750 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBR840 | < v7.2.8.5 | v7.2.8.5 |
| NETGEAR | RBS840 | < v7.2.8.5 | v7.2.8.5 |
References
- https://www.netgear.com/support/product/rbre960 patch product
- https://www.netgear.com/support/product/rbse960 product patch
- https://www.netgear.com/support/product/rbr850 product patch
- https://www.netgear.com/support/product/rbs850 product patch
- https://www.netgear.com/support/product/rbr860 product patch
- https://www.netgear.com/support/product/rbs860 product patch
- https://www.netgear.com/support/product/rbre950 product patch
- https://www.netgear.com/support/product/rbse950 product patch
- https://www.netgear.com/support/product/rbr750 product patch
- https://www.netgear.com/support/product/rbs750 product patch
- https://www.netgear.com/support/product/rbr840 product patch
- https://www.netgear.com/support/product/rbs840 product patch
- https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory vendor-advisory