A security flaw in the certificate validation process of the NETGEAR XR1000 Gaming Router and certain Nighthawk routers was identified. The vulnerability could allow an unauthorized individual to remotely access and take control of the device by exploiting improper certificate validation, which is categorized as CWE-599. This flaw compromises the device’s confidentiality, integrity, and availability by permitting remote control.

The vulnerability affects the NETGEAR MR70 Nighthawk Mesh WiFi 6 Router, the MS70 Nighthawk Mesh WiFi 6 Add‑on Satellite, the RAXE500 Nighthawk AX12 12‑Stream AXE11000 Tri‑Band WiFi 6E Router, and the XR1000 Nighthawk WiFi 6 Pro Gaming Router. Devices running firmware1.0.4.48, RAXE500 V1.2.14.114, or XR1000 V1.0.2.86 contain the issue. Firmware updates listed in the official NETGEAR advisory replace the vulnerable code.

The CVSS score of 4.9 indicates moderate risk, and the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to reach the router via its remote‑management interface and supply a malformed certificate in an HTTPS session. If the router’s remote management is publicly exposed or accessible from outside the local network, the risk is elevated, but the necessary condition is the ability to initiate an HTTPS connection that the router will process without proper certificate validation.