NETGEAR RAX Routers EUVD-2026-98773

Exploitation requires network-adjacent access to the management service of a NETGEAR RAX30, RAX29, or RAX28 router - the attacker must be on the same local/Layer-2 network (wired LAN or Wi-Fi, potentially including guest Wi-Fi), as reflected by AV:A. Once adjacent, no authentication (PR:N) and no user interaction (UI:N) are needed to bypass authentication and access device information or modify administrative settings. The primary limiting factor is the adjacency requirement: the flaw is NOT exploitable from the internet/WAN side under a default configuration, so realistic risk is confined to attackers who have already reached the local network.

This is a moderate-priority flaw whose real-world risk is tempered by its attack vector rather than its impact. The vendor-supplied CVSS 4.0 vector (AV:A) confirms exploitation requires ADJACENT access - an attacker must already be on the same local/Layer-2 network segment (e.g., the router's LAN or Wi-Fi), NOT the open internet - which is the single largest risk-limiting factor and the reason the score lands at 6.3 despite high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). Positive aggravating signals: PR:N (no authentication needed) and UI:N (no user interaction), and the vector flags the issue as automatable (AU:Y), meaning a successful technique could be scripted against many adjacent devices. Mitigating signals dominate the exploitation-likelihood side: the vector's exploit-maturity metric is E:U (unreported/unproven), there is no CISA KEV listing, and no public POC is referenced, so this is NOT currently known to be exploited. There are no conflicting signals in the data - the description ('adjacent access') and the CVSS (AV:A) agree. A patch is available from NETGEAR, which should be the deciding factor: remediation is straightforward and should be applied, but this does not warrant emergency out-of-band response given the adjacency requirement and absence of exploitation evidence.

An attacker who has gained a foothold on the local network - for example, by associating with the router's Wi-Fi (including a guest SSID) or compromising another LAN device - reaches the RAX router's management service and bypasses authentication to read device information or change administrative settings without any credentials. No public exploit code or active exploitation has been identified, and the attack cannot be launched remotely across the internet because adjacent network access is required.