NETGEAR CAX30 CVE-2026-11732

Exploitation requires the Block Sites website-blocking feature to be explicitly enabled on the router - if it is left in its typical disabled state, the vulnerable code path is not reachable. The attacker must additionally have network-adjacent access to the device (AV:A), such as valid WiFi credentials or a position on the LAN, which is the primary limiting factor; no router administrative authentication is required (PR:N) and no user interaction is needed (UI:N). Impact is confined to the router itself (no scope change to downstream systems). This narrows realistic risk to deployments where Block Sites is actively configured and the wireless/LAN perimeter is shared or weakly protected.

This is a moderate-severity, context-dependent flaw rather than a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes a network-adjacent, low-complexity, unauthenticated path with high confidentiality, integrity, and availability impact on the router itself (VC:H/VI:H/VA:H, no subsequent-system impact SC/SI/SA:N), yielding 6.3. Crucially, the same vector carries E:U (exploitation unreported/unproven), and there is no CISA KEV listing and no POC indicator in the input - so no public exploit identified at time of analysis. The signals are internally consistent: adjacency (AV:A, requiring WiFi/LAN access) plus the fact that the vulnerable Block Sites feature must be explicitly enabled sharply narrows the real-world attack surface, which explains why this scores well below critical despite full CIA impact. One nuance to verify: the vector encodes PR:N (unauthenticated to the router) while the description stresses the attacker needs 'network access (such as WiFi credentials)' - these are not contradictory (network/WiFi access is the adjacency precondition, not router authentication), but defenders should treat WiFi access as the de facto barrier to entry. Net: a genuine but lower-probability issue - prioritize patching for exposed/shared-WiFi deployments with Block Sites enabled, below any network-vector or actively-exploited item.

An attacker who has already joined the router's network (e.g., obtained WiFi credentials or sits on the LAN) sends crafted input to the Block Sites website-blocking feature, which fails to validate it properly and executes attacker-supplied commands on the router. This only works when the administrator has turned Block Sites on; no public exploit code is known, so exploitation would currently require independent development.