The vulnerability is an instance of insufficient input validation that allows authenticated local administrators to change router software and configuration beyond authorized limits, effectively granting them the ability to alter critical network settings and compromise device operation.

Affected devices include NETGEAR Orbi routers such as the RBE97x, RBR750, RBR840, RBR850, RBR860, RBRE950, RBRE960, RBS750, RBS840, RBS850, RBS860, RBSE950, and RBSE960; firmware before V9.12.4.9 on the RBE97x or V7.2.8.5 on other models is vulnerable, and models marked with an asterisk have reached end-of-support and should be retired.

The CVSS score of 4.3 indicates moderate severity, and because it requires local administrator access the risk is limited to the local network; although the EPSS is unavailable and the vulnerability is not listed in CISA KEV, organizations should still apply the firmware update promptly to eliminate the privilege‑escalation flaw.