Insufficient input validation in the router's firmware permits a user connected to the local WiFi network to inject and execute operating‑system commands. The flaw is a classic input‑validation weakness (CWE-20) that gives attackers the ability to run arbitrary commands on the device, potentially leading to full device compromise. Because the vulnerability was discovered through firmware emulation and not yet confirmed on production hardware, the exact extent of the impact remains uncertain, but the potential for command execution is clear.

The affected product is the NETGEAR JR6150 AC750 Wi‑Fi router (802.11ac dual‑band, Gigabit, released 2014). No specific firmware versions are listed; the device is already in an End‑of‑Support phase as of 2018, and NETGEAR no longer issues security updates for it. This applies to all routers bearing the JR6150 designation, regardless of firmware revision.

The CVSS score of 4.4 reflects moderate severity; there is no EPSS value and the vulnerability is not cataloged in CISA’s KEV database. Because the flaw allows command execution from the local wireless network, the likely attack vector is an attacker who gains access to the Wi‑Fi network. No exploit has been publicly verified, but the lack of input validation means a determined local user could craft network traffic that triggers the command injection. Without an official fix, the risk persists until the device is replaced or otherwise isolated.