CVE-2026-0414

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

CVSS v3 4.5 MEDIUM

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory	Vendor Advisory
https://www.netgear.com/support/product/rbe970/	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:rbe970_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbe970:-:*:*:*:*:*:*:*

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de validación de entrada insuficiente en los modelos NETGEAR listados permite a los administradores autenticados conectados a la red local realizar modificaciones no autorizadas del software y la funcionalidad del router.

18 Jun 2026, 17:56

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.5
References	~~() https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory -~~	() https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory - Vendor Advisory
References	~~() https://www.netgear.com/support/product/rbe970/ -~~	() https://www.netgear.com/support/product/rbe970/ - Product
CPE		cpe:2.3:o:netgear:rbe970_firmware:::::::: cpe:2.3:h:netgear:rbe970:-:::::::*
First Time		Netgear rbe970 Firmware Netgear Netgear rbe970

10 Jun 2026, 14:16

Type	Values Removed	Values Added
References		() https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory -

09 Jun 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 17:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-0414

Mitre link : CVE-2026-0414

CVE.ORG link : CVE-2026-0414

JSON object : View

Products Affected

netgear

rbe970_firmware
rbe970

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-0414", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0414", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T03:59:28.249232Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.9}], "cvssMetricV40": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "affectedData": [{"vendor": "NETGEAR", "product": "RBE970", "versions": [{"status": "affected", "version": "0", "lessThan": "V9.12.4.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T17:16:58.990", "references": [{"url": "https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory", "tags": ["Vendor Advisory"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}, {"url": "https://www.netgear.com/support/product/rbe970/", "tags": ["Product"], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Insufficient input validation vulnerability in the\u00a0listed NETGEAR models allows\u00a0authenticated administrators connected to the local network to make unauthorized modification of router software and functionality."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de entrada insuficiente en los modelos NETGEAR listados permite a los administradores autenticados conectados a la red local realizar modificaciones no autorizadas del software y la funcionalidad del router."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rbe970_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "301DE3B8-EF02-46C6-96EF-3735CE242BBC", "versionEndExcluding": "9.12.4.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rbe970:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DE1F3088-9598-4EB5-A8A0-E0D4E529CB12"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5"}