The flaw exists in the nr_fw module of ASR Kestrel firmware, specifically within the Code/Nr/nr_fw/RA/src/NrPwrCtrl.C file. An out-of-bound read can allow an attacker to read memory beyond the intended buffer boundaries, potentially exposing sensitive data or internal device state. The weakness is classified as CWE‑125, a type of memory corruption that does not provide immediate code execution but can reveal confidential information.

ASR Kestrel devices running firmware versions released before 10 February 2026 are affected. The issue is scoped to the Kestrel firmware’s nr_fw modules; no further sub‑version information is listed.

The CVSS score of 7.4 indicates a high severity vulnerability, yet the EPSS score is undefined and the vulnerability is not included in the CISA KEV catalog, implying no confirmed exploitation to date. The likely attack vector is external, with a remote actor sending crafted traffic that triggers the out-of-bound read, though the specific exploit path is inferred from standard practices for similar weaknesses.