A flaw in input validation allows an authenticated local network administrator to gain elevated privileges. The vulnerability is an instance of insufficient input validation (CWE‑20). Attackers who possess legitimate administrative credentials can alter router software and functionality, compromising the integrity of the device. No remote exploitation is possible without local admin access.

NETGEAR routers R7000, RAX20, RAX35v2, RAX41, RAX41v2, RAX42, RAX42v2, RAX43, RAX43v2, RAX45, RAX49S, RAX50, RAX50S, RAX50v2, RAX54Sv2, RAX54v2, RAXE450, RAXE500, XR1000, and XR1000v2 are impacted. Firmware revisions listed by NETGEAR (e.g., R7000 V1.0.11.216, RAX20 V1.0.18.144, RAXE500 V1.2.14.114) include the fix. End‑of‑support models such as the R7000 are advised to be retired.

The CVSS score of 1.9 suggests a low severity rating, and the EPSS score is not provided, indicating no known public exploitation. The vulnerability is not in CISA’s KEV catalog. Exploitation requires local administrative credentials; an attacker who succeeds can alter device settings or firmware behavior. The privilege escalation potential, combined with the lack of public exploitation, results in a moderate risk for networks relying on these routers, especially if they are unmanaged or use default admin accounts.