An insufficient input validation flaw in NETGEAR Orbi routers permits an attacker who can connect to the router’s LAN to inject and execute arbitrary operating system commands. The weakness is a classic CWE‑20 scenario, where unsanitized input is passed directly to system calls, enabling the attacker to control command execution on the device. Successful exploitation could allow modification of router configuration, creation of backdoors, or use of the device as a foothold to infiltrate other network equipment.

Affected devices include NETGEAR Orbi models RBE970, RBE971, RBR750, RBR850, RBR860, RBRE960, RBS750, RBS850, RBS860, and RBSE960. Firmware updates that address the issue start with RBE971 9.10.0.2 or later, RBE970 9.10.0.2 or later, RBR750, RBR850, RBR860, RBS750, RBS850, RBS860 7.2.8.5 or later, and RBRE960 and RBSE960 7.2.7.15 or later. Devices running earlier firmware versions are susceptible.

With a CVSS score of 1.1 and an EPSS of less than 1%, the technical severity appears low, yet the flaw remains tactically valuable while an attacker is present on the LAN. Because the attack vector requires local network access and the vendor does not list this CVE in the KEV catalog, the likelihood of widespread exploitation is modest, but the impact of successful exploitation—remote command execution—remains high. Ensuring that only trusted hosts can reach the router’s management interfaces and promptly applying the listed firmware upgrades mitigates the threat.