NETGEAR RBE97x CVE-2026-0414

Exploitation requires two hard prerequisites: (1) the attacker must hold authenticated administrator credentials on the device (PR:H per CVSS vector - standard read-only or unprivileged user accounts are not sufficient), and (2) the attacker must be connected to the local adjacent network (AV:A per CVSS vector - internet-based remote exploitation is not possible). The vulnerability is not exploitable over the public internet, is not automatable (per SSVC), and requires a meaningful access threshold that limits it to insider threats, compromised admin accounts, or malicious actors already present on the local network segment. Non-default configuration is not a prerequisite - the flaw exists in the standard administrative input handling path of the affected firmware versions.

The CVSS 4.0 base score of 4.3 (Medium) is consistent with the constrained attack conditions: adjacent-network access (AV:A) and administrator-level authentication (PR:H) are both hard prerequisites. The integrity impact is marked high (VI:H) with no confidentiality or availability impact, aligning with unauthorized modification of router software and functionality. SSVC reinforces this limited posture - exploitation is classified 'none', the attack is not automatable, and technical impact is only 'partial'. No CISA KEV listing and no public exploit code have been identified at time of analysis. EPSS score was not included in the source data, so probabilistic exploitation rate is unknown. Overall, real-world risk is low for most deployments: this is not remotely exploitable from the internet, cannot be triggered without admin credentials, and has no known active exploitation. Priority should be elevated only in environments with shared admin accounts, insider threat scenarios, or multi-tenant network segments where administrative access is not tightly controlled.

An administrator with valid high-privilege credentials and adjacent network access submits specially crafted input to the RBE97x management interface. Because the router fails to properly validate this input (CWE-94), the injected payload is interpreted as code and executed, allowing the administrator to make unauthorized changes to router firmware or operational settings beyond what their role should permit. No public exploit code exists at time of analysis, and the adjacent-network and admin-credential requirements make opportunistic exploitation unlikely.