NETGEAR R7300DST CVE-2026-107918

Exploitation requires the attacker to (1) be connected to the router's local/adjacent network - not routable from the internet (AV:A) - and (2) already be authenticated as an administrator (PR:H); the specific entry point is the router's LAN Setup configuration feature, which accepts insufficiently validated input. Limiting factors that reduce real-world risk: the high-privilege prerequisite means an attacker must already possess admin credentials, access is confined to the local network, no user interaction by a victim is needed, impact is limited to integrity (configuration changes) with no data disclosure or denial of service, and the vendor reports the issue was only reproduced on simulated firmware, not confirmed on physical R7300DST hardware.

This is a genuinely low-to-moderate priority issue despite the CWE-20 label. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/PR:H/UI:N, VI:H only) scores 4.3 (Medium) and tells a consistent story: exploitation requires adjacent (local-network) access AND high privileges (PR:H = an already-authenticated administrator), with impact limited to integrity (VI:H) and no confidentiality or availability loss. The SSVC/threat metrics reinforce low urgency - E:U (exploit unproven, i.e. no public exploit code), V:D (diffuse value), RE:L (low recovery effort). No EPSS score, KEV listing, or POC was provided, and none is implied. Critically, the description itself states the flaw was 'identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices' - so even the existence of the bug on real hardware is not confirmed by the vendor. The combined picture is a self-reported, unconfirmed, requires-admin-on-LAN integrity issue: real signals all point to low real-world risk, not a high-CVSS-but-overstated case. The 'Authentication Bypass' tag conflicts with the description, which requires an authenticated admin - verify tagging.

An attacker who already holds administrative credentials and is connected to the router's local network (e.g. a malicious insider or someone who obtained the admin password) submits crafted, insufficiently validated input through the LAN Setup feature to make unauthorized changes to the router's configuration. No public exploit code exists, and the vendor notes the behavior was only reproduced against a simulated firmware image, not confirmed on physical devices.