CVE-2026-62655: NETGEAR Orbi DoS Vulnerability

CVE-2026-62655 Overview

CVE-2026-62655 is a stack-based buffer overflow vulnerability [CWE-121] affecting certain NETGEAR Orbi mesh Wi-Fi systems. An unauthenticated attacker on an adjacent network can send crafted input that causes the device to stop responding or restart unexpectedly. Successful exploitation disrupts network connectivity and renders the affected Orbi router or satellite temporarily unavailable.

The issue was disclosed in the NETGEAR Security Advisory published in July 2026 and impacts multiple Orbi router and satellite models across the RBR, RBRE, RBS, and RBSE product families.

Critical Impact
An adjacent, unauthenticated attacker can trigger a denial-of-service condition on vulnerable Orbi devices, disrupting Wi-Fi and wired connectivity for all downstream clients until the device reboots.

Affected Products

NETGEAR Orbi RBR860 / RBS860 (router and satellite)
NETGEAR Orbi RBRE950 / RBSE950 (router and satellite)
NETGEAR Orbi RBRE960 / RBSE960 (router and satellite)

Discovery Timeline

2026-07-14 - CVE-2026-62655 published to NVD
2026-07-15 - Last updated in NVD database
July 2026 - NETGEAR publishes security advisory referencing this issue

Technical Details for CVE-2026-62655

Vulnerability Analysis

CVE-2026-62655 is classified as a stack-based buffer overflow [CWE-121]. The flaw resides in code paths reachable by an attacker on the same Wi-Fi or local network segment as the Orbi device. When the vulnerable component processes attacker-controlled input, it writes past the bounds of a fixed-size stack buffer.

The out-of-bounds write corrupts adjacent stack memory, including saved return addresses and control data. This corruption forces the device to crash and reboot, interrupting all routing and wireless services provided by the mesh node.

While the CVSS vector indicates high availability impact, confidentiality and integrity are not affected. There is no indication in the advisory that the flaw yields code execution, and no public proof-of-concept exploit is available at the time of publication.

Root Cause

The root cause is missing or incorrect bounds validation before copying attacker-supplied data into a stack-allocated buffer within the Orbi firmware. Because the buffer resides on the stack, overwriting it destabilizes the calling function and triggers a device fault.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must be connected to the same LAN or wireless network as the target Orbi device. No authentication or user interaction is required. An attacker within range of the guest or corporate SSID, or on a wired LAN port, can repeatedly send malformed traffic to knock the device offline.

Because no verified proof-of-concept is publicly available, technical exploitation details are limited to the vendor advisory. Refer to the NETGEAR Security Advisory July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-62655

Indicators of Compromise

Unexpected reboots of Orbi router or satellite units with no scheduled maintenance window
Loss of mesh backhaul connectivity between the Orbi router and satellites
Wireless clients repeatedly deauthenticated as the access point restarts
Gaps in DHCP lease renewals or DNS resolution originating from the Orbi gateway

Detection Strategies

Monitor SNMP or syslog output from the Orbi device for repeated reboot, watchdog, or kernel panic events
Correlate short outages on downstream client devices with router uptime resets
Baseline normal Orbi uptime and alert on sudden drops or reboot loops
Inspect wireless intrusion detection logs for abnormal frame volumes from a single adjacent client MAC

Monitoring Recommendations

Enable remote logging from the Orbi device to a central syslog or SIEM collector
Track device uptime metrics through the NETGEAR management interface or SNMP polling
Alert on anomalous burst traffic from unauthenticated wireless clients targeting management services

How to Mitigate CVE-2026-62655

Immediate Actions Required

Apply the firmware update referenced in the NETGEAR Security Advisory July 2026 to each affected Orbi router and satellite
Restrict Wi-Fi access to trusted clients only and disable open guest networks until patched
Segment IoT and guest devices onto a separate SSID or VLAN to reduce the pool of potential adjacent attackers
Verify that remote management from the WAN interface is disabled

Patch Information

NETGEAR has published fixed firmware for the affected Orbi models. Download and installation instructions are available on the product support pages: RBR860, RBS860, RBRE950, RBSE950, RBRE960, and RBSE960. Confirm the running firmware version through the Orbi admin interface after upgrading.

Workarounds

Enforce WPA3 or WPA2-Enterprise authentication to limit which clients can reach the vulnerable network stack
Use MAC address filtering to restrict Wi-Fi association where feasible
Physically secure LAN ports to prevent unauthorized wired access to the mesh
Reboot the Orbi device and monitor logs if repeated crashes are observed while a permanent patch is scheduled