NETGEAR Orbi EUVD-2026-44327

The attacker must be present on the same adjacent network as the Orbi device - either connected to the same Wi-Fi SSID (including guest network if enabled), the wired LAN, or a directly bridged network segment. No authentication is required (PR:N from the CVSS 4.0 vector), and no special configuration beyond default deployment is implied by the description. Exploitation is limited to the local network broadcast domain; internet-based remote exploitation is not possible given AV:A. The attack requires no user interaction. The specific network-facing service or protocol that processes the malformed input is not identified in available data. Impact is limited to device availability (crash/restart) with no confidentiality or integrity compromise. A proof-of-concept exists, lowering the skill bar for exploitation.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) reflects a purely availability-impacting DoS with no confidentiality or integrity loss, constrained to adjacent-network attackers. This adjacency requirement (AV:A) significantly limits the attack surface compared to internet-facing vulnerabilities - an attacker must be on the same local network segment, Wi-Fi broadcast domain, or directly connected network. The 5.7 base score is consistent with this scoping. Critically, the supplemental metric E:P (exploit proof-of-concept exists) elevates practical concern: the theoretical flaw has been demonstrated, meaning exploitation is not merely speculative. There is no CISA KEV listing, so active in-the-wild exploitation is not confirmed. For home and small-business users, the primary threat model is a malicious guest or neighbor with Wi-Fi access disrupting connectivity. EPSS data is absent from the input, so probabilistic exploitation likelihood cannot be quantified. The impact is temporary (device restarts and recovers), but repeated triggering could constitute sustained denial of service. No conflicting signals are present: CVSS, CWE, and description are all internally consistent for a stack-overflow-driven crash.

An attacker connected to the same Wi-Fi network or wired LAN segment as an unpatched NETGEAR Orbi router sends a specially crafted network request - likely targeting a management service or Orbi backhaul protocol - that triggers a stack-based buffer overflow in the device firmware. A proof-of-concept exploit exists (E:P), meaning the specific payload format and target service have already been identified and demonstrated. The overflow corrupts the stack frame, causing the service to crash and the device to restart, dropping all network connectivity for users on that segment until the reboot completes; an attacker could repeat this to sustain the outage.