A flaw in the firmware of certain NETGEAR gaming routers permits adversaries who can intercept and modify the data flowing between the router and the Internet to run arbitrary code on the device. This shortage of input validation makes it straightforward for an attacker who can tamper with upstream traffic to cause the router to execute commands, potentially compromising network control and exposing connected devices. The vulnerability allows code execution with the privileges that the router itself functions under, which effectively removes its ability to enforce network security.

The vulnerability affects NETGEAR MR70, MS70, RAXE500, and XR1000 gaming routers. Devices running firmware versions earlier than MR70 V1.0.4.48, MS70 V1.0.4.48, RAXE500 V1.2.14.114, or XR1000 V1.0.2.86 are vulnerable. Updated firmware is available from the NETGEAR support pages linked in the advisory.

The CVSS base score of 6.9 indicates medium severity. No EPSS score is provided, and the weakness is not listed in CISA’s KEV catalog, so the public exploitation likelihood is uncertain. The attack requires an actor who can intercept and tamper with traffic between the router and the upstream Internet interface, suggesting a network‑oriented attacker, possibly at the ISP line or a compromised local device. If such conditions are met, the attacker can inject malformed packets that trigger the code‑execution path.