The vulnerability is a classic stack-based buffer overflow that arises from insufficient input validation in the router firmware. An attacker who is an authenticated administrator on the local network can send crafted data that overflows a buffer, allowing the attacker to modify configuration settings or inject malicious code. This abuse of administrative privileges undermines the integrity of the router and can lead to loss of control over routing and security functions.

The vulnerable devices are a range of NETGEAR Nighthawk routers, including models RBE37X, RBE77X, RBR750, RBR840, RBR850, RBR860, RBRE950, RBRE960, RBS750, RBS840, RBS850, RBS860, RBSE950, and RBSE960. Firmware versions prior to the fixed releases listed in the vendor advisory are affected. The fixed firmware versions are V12.1.2.1 for RBE37X, V10.5.20.10 for RBE77X, and V7.2.8.5 for all other listed models. Models that have reached End‑of‑Support cannot receive security updates, and the vendor recommends retiring them for continued protection.

The CVSS score is 4.3, indicating low to moderate severity. No EPSS score is published, and the vulnerability is not in the CISA KEV catalog. Because exploitation requires an authenticated administrator on the local network, the attack vector is likely limited to local intruders. Nonetheless, the flaw permits modification of core router functions, potentially compromising data confidentiality, integrity, or availability if a privileged local attacker succeeds.