NETGEAR C6220/C6230 CVE-2025-12941

The attacker must be connected to the device's local WiFi network (AV:A adjacent - not exploitable from the internet) AND must hold valid low-privilege authentication on the router (PR:L), such as a standard WiFi user account or credentials. The CVSS 4.0 AT:P indicates an additional attack requirement/condition must be met for success. Limiting factors that reduce real-world risk: exploitation is confined to attackers with WiFi access and credentials, the impact is availability-only (a reboot/DoS with no data exposure or code execution), and it affects only the specific NETGEAR C6220 and C6230 DOCSIS 3.0 cable modem + WiFi router models.

This is a genuinely low-to-moderate priority issue despite the medium CVSS. The authoritative CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:L/UI:N) confirms the attack is NOT remote/internet-facing - it requires adjacent (local WiFi) network position AND low-level authentication (PR:L), meaning the attacker must already be a connected, credentialed WiFi user. Impact is limited strictly to availability (VA:H) via an unauthorized reboot; there is no confidentiality or integrity impact (VC:N/VI:N). The EPSS score of 0.20% (8th percentile) is low and consistent with this constrained attack surface. The vector's E:P (Proof-of-Concept) threat metric indicates exploit code maturity at the PoC level, but the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. Signals are largely coherent rather than conflicting: low EPSS + no KEV + adjacent/authenticated vector + availability-only impact all point to a nuisance-grade local DoS, not a widespread threat. One conflict to flag: the CWE (CWE-306, Missing Authentication for a Critical Function) and the 'Authentication Bypass' tag both imply an authentication deficiency, yet the description explicitly states the attacker is an 'authenticated local WiFi user' (matching PR:L) - verify with NETGEAR whether the reboot function itself lacks sufficient authorization checks for low-privilege users.

An attacker already connected to the device's WiFi (e.g., a guest, a user with the WiFi password, or someone on a shared/compromised SSID) with only low-level credentials sends a crafted request to the router's management function that triggers a reboot. Repeating this creates a sustained denial of service, knocking all users off the internet each time the modem/router restarts. The CVSS 4.0 E:P metric indicates proof-of-concept exploit code maturity, though no active exploitation is reported.