CVE-2026-0409
Low
No strong exploitation signal.
CVSS base
6.4
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
0.3%
17.7th percentile
CISA KEV
Not listed
Weakness / dates
CWE-119
Published 2026-06-09 · modified 2026-07-23
CVSS breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | N | Network |
| Attack Complexity | H | High |
| Privileges Required | H | High |
| User Interaction | R | Required |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | H | High |
Timeline
- 2026-06-09 — Published (NVD)
- 2026-07-23 — Last modified (NVD)
Description
A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the router and the Internet to run commands on your device when the device administrator performs certain specific management actions. This issue affects NETGEAR Orbi 370 series devices before V12.1.2.7.