CVE-2026-123178 · Infrastructure
NO FIX YET
NETGEAR Orbi routers have an input validation flaw that lets an authenticated administrator on the local network run unauthorized commands. An attacker could change the router's software and functionality, which compromises the device's integrity.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only the listed NETGEAR Orbi router models are named, and the attacker must already be an authenticated administrator on the local network. Teams that run Orbi routers on a local network should check firmware; those with no Orbi devices can skip it. The sources do not list the affected firmware versions.
Not affected if no-orbi-routers, unauthenticated-only-exposure
Who cares home-router, netgear, orbi
No fix yet, per the sources.
An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected device.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:Amber
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.