An insufficient input validation flaw in the PPPoE Setup interface of the NETGEAR R7300 router allows administrators who are already authenticated within the local network to perform actions that normally fall outside their authorized scope. The issue was identified through testing in a controlled environment using a simulated version of the router's software and has not yet been confirmed on physical production devices. The vulnerability does not provide remote access or other capabilities beyond the local administrative context.

The flaw affects the NETGEAR R7300DST line, including the Nighthawk AC1900 DST Router & Adapter. The affected firmware is listed as R7300DST (EoS). Because the model has reached End‑of‑Support, NETGEAR has not released any additional security updates and recommends retiring the device and migrating to a supported NETGEAR model.

The CVSS score of 4.3 places the vulnerability in the medium severity range. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Likely attack vectors involve a local or LAN‑based user who has administrative privileges on the router’s web interface; from that position the malformed PPPoE Setup request could enable unauthorized actions. Since the vulnerability requires compromised local access and has not yet been confirmed on production hardware, the exploitation risk is limited to already compromised or misconfigured routers that are accessible on the local network.