Some end‑of‑service NETGEAR devices expose a TelnetEnable function that can be triggered by a specially crafted magic packet, turning on the telnet daemon without authentication. This deficiency enables an attacker who can send such a packet to obtain a shell on the device, potentially allowing arbitrary code execution. The flaw corresponds to CWE‑1242, which describes unintended activation of a feature.

The vulnerability affects NETGEAR products that are no longer supported and lack end‑of‑life firmware updates. No specific versions are listed, so any currently in‑use end‑of‑life device may be vulnerable.

The CVSS score of 8.7 indicates a high severity defect, while the EPSS of less than 1% suggests a low probability of exploitation at present. The device is not listed in the CISA KEV catalog, so no exploits are known yet. The likely attack vector is network‑based: an attacker on the same network or with routing capabilities must deliver the magic packet. Once activated, telnet typically runs with elevated privileges, so successful exploitation could lead to full system compromise.