NETGEAR RBS750 Firmware vulnerabilities

134 CVEs affecting NETGEAR RBS750 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0418, published 2026-06-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-14440, published 2020-06-18. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before…
CVE-2022-37337, published 2023-03-21. High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days. A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead to arbitrary command execution. An…
CVE-2021-45612, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68,…
CVE-2020-14439, published 2020-06-18. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before…
CVE-2021-45622, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68,…
CVE-2020-14436, published 2020-06-18. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before…
CVE-2020-26902, published 2020-10-09. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before…
CVE-2022-38452, published 2023-03-21. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request can lead to arbitrary command execution.…
CVE-2021-45617, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, EAX20 before 1.0.0.48, EAX80 before 1.0.1.64, EX7500 before 1.0.0.72,…
CVE-2021-45621, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68,…

Latest

CVE-2026-0418, published 2026-06-09. Medium severity, CVSS 4.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.
CVE-2026-0415, published 2026-06-09. Medium severity, CVSS 4.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and…
CVE-2026-0413, published 2026-06-09. Medium severity, CVSS 4.5. EPSS: 0.3% chance of exploitation in the next 30 days. A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification…
CVE-2026-0405, published 2026-01-13. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.
CVE-2026-0404, published 2026-01-13. High severity, CVSS 8.0. EPSS: 1.1% chance of exploitation in the next 30 days. An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on…
CVE-2026-0403, published 2026-01-13. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.
CVE-2022-38458, published 2023-03-21. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-middle attack can lead to a disclosure of…
CVE-2022-36429, published 2023-03-21. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command…