An insufficient input validation flaw in the DHCPv6 handling of NETGEAR Orbi routers allows authenticated attackers on WiFi or LAN to inject and execute operating‑system commands on the device. The vulnerability is a classic case of CWE‑20, where user input is not properly sanitized before being passed to the underlying shell. Successful exploitation would give the attacker control over the router, enabling lateral movement, traffic interception, or denial of service for connected devices.

The flaw affects NETGEAR Orbi line devices including RBR750, RBR840, RBR850, RBR860, RBS750, RBS840, RBS850, RBS860, RBRE950, RBRE960, RBSE950, and RBSE960. Firmware versions earlier than v7.2.8.5 are vulnerable; all models have a patch in firmware v7.2.8.5 or newer.

The CVSS score of 4.8 categorizes the issue as a moderate risk, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known active exploits. Attackers must be locally or WiFi‑authenticated and the DHCPv6 feature must be enabled, which is not the default setting, further limiting the attack surface.