The vulnerability is a stack‑based buffer overflow caused by insufficient input validation in the firmware of certain NETGEAR Nighthawk routers. An attacker who has authenticated administrative access on the local network can exploit this flaw by sending crafted data that overflows a buffer, enabling unauthorized modification of router software or configuration. The result is a loss of integrity for the device’s software and settings, potentially compromising its routing and security functions.

The affected devices are NETGEAR Nighthawk routers with the following model identifiers: RBE370, RBE770, RBR750, RBR840, RBR850, RBR860, RBRE950, RBRE960, RBS750, RBS840, RBS850, RBS860, RBSE950, and RBSE960. Firmware versions prior to the fixed releases identified in the vendor advisory are vulnerable. The fixed firmware versions are V12.1.2.1 for RBE370, V10.5.20.10 for RBE770, and V7.2.8.5 for all other listed models. Models RBR840 and RBS840 have reached End‑of‑Support and will not receive future security updates; NETGEAR recommends retiring those devices.

The CVSS score of 4.3 indicates a low‑to‑moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local, authenticated administrative access, so the attack vector is likely limited to individuals who can already reach the router management interface. Despite the modest severity, an attacker who succeeds can alter core router functions, potentially disrupting network operation or enabling further compromise of connected devices.