Netgear EX8000 CVE-2025-50526

Exploitation requires reaching the EX8000's management interface and submitting input to the switch_status function that is passed unsanitized into a system command (CWE-77). The available sources do not describe the precise trigger (which parameter, endpoint, or whether prior authentication is needed), so those specifics are unverified. Limiting factors: the affected scope is narrowly a single firmware build (1.0.0.126) of one consumer extender model, and in practice a Wi-Fi mesh extender's administrative functions are typically exposed only on the local/trusted network rather than the public Internet, which constrains realistic reachability despite the AV:N rating. Authentication requirements are not confirmed from the available data beyond the CVSS PR:N claim.

Signals are mixed but lean toward elevated priority. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) models an unauthenticated, low-complexity network attack achieving full compromise, consistent with CWE-77 command injection yielding device takeover. Against this, EPSS is only 1.18% (67th percentile), indicating low modeled probability of broad exploitation in the near term - typical of niche consumer networking gear rather than mass-scanned enterprise targets. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. The vuln.today decision label is act_now, which elevates urgency. Two public references (a PDF writeup and an MP4 demonstration) exist on GitHub, so a public PoC reference exists, but it is not verified as working exploit code. Net assessment: the CVSS/SSVC-style act_now signal and PoC references justify prompt remediation, but the low EPSS and absence of KEV suggest this is targeted/opportunistic rather than widespread exploitation. Note a likely tension to verify with the vendor: CVSS asserts AV:N/PR:N, yet management of a Wi-Fi mesh extender's switch_status administrative function is typically reachable only from the LAN and often behind authentication - the sources do not describe the trigger, so the true access requirement should be confirmed.

An attacker able to reach the EX8000's web management interface sends a crafted request to the switch_status function, injecting shell metacharacters into a parameter that is passed to a system command, resulting in arbitrary command execution on the device (typically as root on this class of hardware). A public PoC reference exists (GitHub PDF writeup plus an MP4 demonstration); it is not verified as working exploit code. Realistically this requires network/LAN reachability to the extender's management plane, consistent with the stated AV:N/AC:L.