The vulnerability allows authenticated administrators connected to the local network to change router configuration settings beyond the intended limits. This flaw, identified as an input validation weakness (CWE-20), can enable an attacker with administrative privileges to alter network behavior, potentially disrupting services or weakening network security. The impact is limited to devices that have not applied the latest firmware update and remains within the reach of local administrators.

NETGEAR RAXE450 routers with firmware versions older than V1.2.14.114 and NETGEAR RAXE500 routers with firmware versions older than V1.2.14.114 are affected. The fix is provided in firmware release V1.2.14.114 for both models.

The CVSS score of 4.3 indicates a low to moderate severity. The EPSS score is not available, but the flaw is not listed in the CISA KEV catalog, suggesting no known public exploitation. The likely attack vector is through the standard local management interface, requiring authenticated administrator access and local network connectivity. An attacker with these prerequisites can modify router functionality beyond intended limits. The risk is mitigated by updating firmware and restricting management access.