NETGEAR Routers EUVD-2026-98771

Exploitation requires three concurrent prerequisites explicitly stated in the data: (1) the attacker must be connected to the router's local/adjacent network (CVSS AV:A - not exploitable from the internet); (2) the attacker must already hold the router's administrator credentials (CVSS PR:H); and (3) the attacker must reach the time-server (NTP) configuration setting, where insufficient input validation allows injected commands. These factors sharply limit realistic risk: an attacker needs full admin access on the LAN before the bug is reachable, so it is primarily a post-compromise integrity/privilege concern rather than a remote attack. Affected models are CBR40, R7000, R7000P, and RAX40; a vendor patch is available.

This is a genuine but low-priority medium-severity issue (CVSS 4.0 base 4.3). The strongest mitigating signals dominate: the CVSS 4.0 vector shows AV:A (adjacent/local network, not internet-facing) and PR:H (attacker must already possess the router's administrator credentials), so the attacker is already authenticated as admin on the LAN before this flaw is even reachable. The CVSS Exploit Maturity is E:U (unproven - no known exploit), and the input provides no EPSS score, no CISA KEV listing, and no POC reference, which is consistent with no public exploitation activity. Impact is narrow: VI:H integrity only, with VC:N and VA:N (no confidentiality or availability impact), meaning the real-world outcome is command execution to tamper with router behavior by someone who already controls the admin interface - a meaningful privilege-to-OS-command escalation but one gated behind full admin access. Note a tagging conflict: the input Tags include 'Authentication Bypass,' which directly contradicts the CVSS PR:H and the description's requirement for valid administrator credentials - this is not an authentication bypass and the tag should be disregarded. No EPSS or KEV data was supplied, so exploitation-probability signals are simply absent rather than low.

An attacker already on the router's LAN (e.g., a malicious insider, a guest-network pivot, or malware on a LAN host) who has obtained or defaulted administrator credentials logs into the NETGEAR web UI, navigates to the NTP time-server configuration, and submits a crafted time-server value that the firmware fails to validate, injecting OS commands. No public exploit code is identified at time of analysis (CVSS E:U), so exploitation would currently require custom tooling.