NETGEAR Orbi EUVD-2026-35456

Attacker must be physically or logically present on the adjacent local network (LAN or Wi-Fi segment) served by the affected Orbi device - AV:A confirms internet-based exploitation is not possible. No authentication is required (PR:N) and no user interaction is needed (UI:N). No special non-default configuration is required (AT:N, AC:L), meaning any default-deployed affected device on a reachable local segment is vulnerable. Exploitation is limited to denial-of-service (VA:H only); there is no confidentiality or integrity impact, and subsequent system impact is absent (SC:N, SI:N, SA:N). The primary limiting factor is the adjacent-network requirement: an external attacker cannot exploit this without first gaining local network access. Devices with strict client isolation (e.g., guest-mode isolation that prevents client-to-router communication beyond DHCP/DNS) may reduce, but not necessarily eliminate, the attack surface depending on which interface is affected.

Real-world risk is moderate and scoped. CVSS 4.0 scores this at 4.9, with the key limiting factor being AV:A (adjacent network only) - the attacker must already be on the same LAN or Wi-Fi segment as the device, precluding remote internet exploitation. AC:L and AT:N indicate no special conditions or configurations are required once within network range, and PR:N confirms no authentication is needed. The impact is exclusively availability (VA:H) with no confidentiality or integrity loss (VC:N, VI:N). The exploitation status flag E:U (Unproven) and the absence of a KEV listing both suggest no known active or public exploitation. The CVSS urgency rating of U:Amber and remediation effort RE:L reinforce that this is not an emergency-tier vulnerability but warrants prompt patching, particularly in environments where device unavailability is operationally significant (e.g., home offices, SMB networks where Orbi is the sole routing path). EPSS data was not provided; risk should be treated as low-to-medium given the adjacent-network constraint.

An attacker connected to the same Wi-Fi network as an unpatched NETGEAR Orbi router - such as a guest, a rogue device, or an attacker who has joined an open or weakly secured network - crafts and transmits specially formed network requests to the router's local-facing service. The malformed input triggers an out-of-bounds write in the request-parsing code, corrupting memory and causing the router process or device to crash, cutting off internet and LAN connectivity for all users until the device reboots. No authentication is required, and no public exploit code has been identified, though the low complexity suggests the crash condition is reproducible through fuzzing.