NETGEAR ReadyCloud CVE-2026-0420

Exploitation requires the attacker to achieve a man-in-the-middle network position between the affected NETGEAR router and the ReadyCloud cloud service - this is not achievable from an arbitrary internet vantage point and is the primary limiting factor (reflected in CVSS AC:H and AT:P). The ReadyCloud remote access feature must be enabled and in active use on the router; devices where ReadyCloud is disabled have no attack surface. No authentication is required from the attacker (PR:N), and no user interaction is needed (UI:N) once the MiTM position is established. Exploitation is constrained to confidentiality impact only - the attacker can observe traffic but cannot modify it or disrupt availability per the CVSS scope. The non-default requirement of a privileged network position and the active use of ReadyCloud together significantly narrow the realistic victim population.

The overall risk is moderate-to-low despite the High confidentiality impact (VC:H) flagged in the CVSS vector, because multiple mitigating signals converge. CVSS 4.0 scores this 4.6 (Medium), weighed down by AC:H (the attacker needs a difficult-to-obtain network position) and AT:P (additional prerequisites beyond mere network access). SSVC assessment independently scores exploitation as 'none,' automatable as 'no,' and technical impact as 'partial,' aligning with the CVSS complexity signals - mass exploitation is not feasible. The exploit maturity modifier E:U (unreported) further confirms no known weaponization. There is no CISA KEV listing and no public POC. The sole confirmed impact is confidentiality (VI:N, VA:N), meaning integrity and availability are unaffected. The real-world risk is primarily relevant to environments where ReadyCloud remote access is actively used and where an adversary can realistically achieve a MiTM position (e.g., compromised LAN, rogue Wi-Fi, or ISP-level interception). For users who do not use the ReadyCloud feature, the attack surface is effectively absent.

An attacker who has achieved a MiTM network position - for example, through ARP spoofing on the local network, a rogue access point, or a compromised upstream network hop - intercepts the TLS connection initiated by the ReadyCloud client app on the router. Because the app fails to properly validate the server's certificate, the attacker presents a self-signed or attacker-controlled certificate, the client accepts it, and the attacker gains full visibility into the encrypted ReadyCloud session traffic, potentially exposing credentials or session tokens. No public POC exists, and successfully staging this attack requires non-trivial network positioning.