A flaw in the firmware of certain NETGEAR gaming routers allows adversaries who can intercept and tamper with traffic flowing between the router and the Internet to trigger code execution on the device. This insufficiency in input validation means that malformed packets crafted by an attacker can be processed by the router in a way that causes it to run arbitrary code or commands with the privileges the device normally holds. The compromise potentially undermines the router’s ability to enforce network protection and can lead to broader network control loss.

The vulnerability affects NETGEAR MR70, MS70, RAXE500, and XR1000 gaming routers. Devices running firmware versions earlier than MR70 V1.0.4.48, MS70 V1.0.4.48, RAXE500 V1.2.14.114, or XR1000 V1.0.2.86 are vulnerable. Updated firmware is available from the NETGEAR support pages linked in the advisory.

The CVSS base score of 6.9 indicates medium severity. The EPSS score of 0.00227 (0.227%) shows a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so public exploitation remains unlikely. Based on the description, it is inferred that the attack requires the attacker to intercept and tamper with traffic between the router and the upstream Internet interface, indicating a network‑oriented vector such as a compromised ISP line or local device. If such conditions exist, the attacker can inject malformed packets that trigger the code‑execution path.