NETGEAR Orbi 370 CVE-2026-0409

Exploitation requires two specific, concurrent conditions: first, the attacker must hold an active man-in-the-middle position on the network path between the NETGEAR Orbi 370 device and the internet (AT:P - Additional Prerequisites required per CVSS 4.0 vector), which rules out passive or purely remote exploitation from the open internet; second, the device administrator must actively perform one of the specific management actions that triggers the vulnerable firmware code path (UI:A - Active user interaction required). The attacker requires no prior authentication to the device itself (PR:N). Exploitation is further constrained by high attack complexity (AC:H), reflecting the precision required to inject the malicious payload at exactly the right moment in the management transaction. Limiting factors include: the requirement for network-path interception capability, the dependency on an admin management event occurring during the attack window, and the fact that the scope of impact is limited to the vulnerable device itself with no lateral movement to downstream network segments indicated by the CVSS data (SC:N/SI:N/SA:N).

The CVSS 4.0 base score of 4.8 (Medium) accurately reflects the constrained real-world exploitability of this vulnerability. The vector AV:N/AC:H/AT:P/PR:N/UI:A/E:U imposes three compounding preconditions: the attacker must achieve a MitM position on the path between the router and the internet (AT:P - additional prerequisites), attack complexity is rated High (AC:H), and active user interaction in the form of a specific admin management action is required (UI:A). Despite the Vulnerable Component impact scores being uniformly High (VC:H/VI:H/VA:H - full CIA compromise of the router), the Subsequent System scores are all None (SC:N/SI:N/SA:N), limiting blast radius to the device itself. The exploit maturity modifier E:U (Unreported) confirms no public exploit code is known, and the vulnerability is not listed in CISA's KEV catalog, meaning no confirmed active exploitation has been observed. EPSS data was not provided in the intelligence feed, so exploitation probability over a 30-day window cannot be quantified. In practice, this is a realistic but non-trivial attack requiring ISP-level or local network positioning combined with precise timing - making opportunistic mass exploitation unlikely but targeted attacks against specific high-value router deployments plausible.

An attacker with the ability to intercept traffic between the Orbi 370 router and the internet - for example through ARP spoofing on a local network, a compromised upstream router, or a rogue ISP-level hop - positions themselves inline on the management traffic path. When the device administrator initiates a specific management action (such as a firmware check or cloud configuration sync), the attacker injects a maliciously crafted response that triggers the buffer overflow in the firmware's response-parsing routine, resulting in arbitrary command execution on the router. No public proof-of-concept code has been identified, but the attack is conceptually straightforward for a skilled attacker who can achieve the required network position.