An insufficient input validation flaw in specific NETGEAR router models allows an authenticated administrator with local network access to submit crafted input that bypasses management interface restrictions, enabling unauthorized modification of protected router software or functionality. This input validation weakness (CWE-20) can let an attacker with administrative rights alter network settings beyond intended limits, potentially disrupting services or weakening network security. The impact is confined to routers that have not yet updated to the latest firmware and remains within the reach of local administrators.

NETGEAR RAXE450 routers with firmware versions older than V1.2.14.114 and NETGEAR RAXE500 routers with firmware versions older than V1.2.14.114 are affected. The fix is provided in firmware release V1.2.14.114 for both models.

The CVSS score of 4.3 indicates a low to moderate severity. The EPSS score is < 1%, but the flaw is not listed in the CISA KEV catalog, suggesting no known public exploitation. The likely attack vector is through the standard local management interface, requiring authenticated administrator access and local network connectivity. An attacker with these prerequisites can modify router functionality beyond intended limits. The risk is mitigated by updating firmware and restricting management access.