The vulnerability is a stack‑based buffer overflow that can be triggered by an authenticated administrator. Exploitation allows the attacker to modify the router’s firmware or operational behavior, effectively giving them high‑level control over the device. The weakness is identified by CWE‑121, a classic buffer overflow flaw that can be used for remote code execution when the overflow is successfully triggered.

Affected devices include NETGEAR Nighthawk R7000, RAX20, RAX35v2, RAX41, RAX41v2, RAX42, RAX42v2, RAX43, RAX43v2, RAX45, RAX49S, RAX50, RAX50S, RAX50v2, RAX54Sv2, RAX54v2, RAXE450, RAXE500, XR1000, and XR1000v2. Firmware versions before the fixed releases are vulnerable. The patched firmware versions that fix the issue are: V1.0.16.132 or V1.1.4.28 on RAX35v2, RAX41v2, RAX42v2, RAX43, RAX43v2, RAX49S, RAX50v2, RAX54Sv2, RAX54v2, and V1.2.14.114 on RAXE500, as well as V1.1.0.22 on XR1000 and XR1000v2. Devices marked End‑of‑Support (EoS) such as R7000, RAX20, RAX45, RAX50S, RAXE450, and others no longer receive security updates and should be retired.

The CVSS score of 1.9 indicates low severity when assessed in isolation, and the EPSS score is not available. The vulnerability requires authenticated admin access, often via the web interface, so the likely attack vector involves an attacker who has already gained local or remote administrative credentials. Because the issue is a buffer overflow, the risk of exploitation is high if the attacker can reach the vulnerable code; however, the overall likelihood is uncertain given the absence of EPSS data and the lack of listing in KEV. Network administrators should treat this as a potential privilege‑escalation vector that can lead to remote code execution on affected routers.