The vulnerability stems from an insufficient input validation flaw that allows an attacker connected to the router’s LAN to inject and execute arbitrary operating‑system commands. This flaw can lead to full compromise of the device, enabling an attacker to access sensitive network resources, modify configuration, or launch further attacks against other devices on the local network.

Affects the NETGEAR Nighthawk XR1000v2 router. All firmware versions earlier than 1.1.2.34 are vulnerable. The issue is specific to the XR1000v2 model; devices with firmware 1.1.2.34 or newer are considered patched.

The severity scored as CVSS 6.1 indicates a moderate level of risk, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local network; an attacker must establish a connection to the router’s LAN interface to exploit the flaw. No additional prerequisites beyond LAN access are specified in the advisory.