This vulnerability permits an unauthenticated user on the local network to take control of the router, enabling them to modify any configuration or settings. The weakness arises from insufficient input validation (CWE‑20). Gaining such control can compromise network confidentiality, integrity, and availability.

The affected devices are NETGEAR routers built on the CAX30, RAX30, RAX5, and RAXE300 platforms. Vulnerable versions include CAX30 firmware up to V2.2.1.4, RAX30 firmware up to V1.0.10.94, RAX5 firmware up to V1.0.5.34, and RAXE300 firmware up to V1.0.10.72. Firmware versions beyond those listed contain the fix.

The CVSS score of 5.2 places the vulnerability in the moderate severity range. Although the official EPSS score is not available, the lack of external exploitation data suggests lower likelihood of public exploit, yet local attackers present a realistic threat. The vulnerability is not yet in the KEV catalog. An attacker on the LAN can send malicious commands to the router without authentication, potentially enabling network disruption or eavesdropping.