This vulnerability is a case of insufficient input validation (CWE‑20). An authenticated local administrator can supply crafted input that causes the router to apply unauthorized changes to its firmware or configuration. The flaw allows modification of routing tables, firmware versions, or enabled features, giving the attacker unintended control over the device and the opportunity for persistence, lateral movement, or denial of service within the local network.

All NETGEAR router models listed under the CVE (EX3700, EX3800, EX6120, EX6130, MR60, MR70, MR80, MS60, MS70, MS80, R6400v2, R6700v3, R6900P, R7000, R7000P, R7960P, R8000P, R8500, RAX20, RAX35v2, RAX40v2, RAX41, RAX42, RAX43, RAX45, RAX48, RAX50, RAX50S, RAXE450, RAXE500, XR1000) running any firmware version earlier than the fixes listed for each model. Models marked with an asterisk have reached End‑of‑Support and will not receive future security updates.

The CVSS score of 4.9 indicates moderate severity. Exploitation requires local network access and valid administrative credentials. No publicly known exploits are listed in the CISA KEV catalog and EPSS is unavailable. The attack vector is an authenticated local administrator, so defenders should limit administrative privileges to trusted staff and ensure firmware is regularly updated to eliminate the vulnerable code path.