Rs700
Monthly
Insufficient input validation across three NETGEAR router models - R7000, RAXE500, and RS700 - permits authenticated administrators with adjacent network access to make unauthorized modifications to router software and core functionality beyond what their role should allow. The flaw is classified as CWE-20 and carries a CVSS 4.0 score of 4.3, constrained to local-network, high-privilege attack scenarios with no observed public exploitation. NETGEAR has self-reported the issue and published patch resources via product-specific support pages; no public exploit code has been identified at time of analysis.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches.
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authenticated administrators on the local network to manipulate device configuration beyond intended boundaries, classified under CWE-15 (External Control of System or Configuration Setting). The CVSS 4.0 vector (AV:A/PR:H/VI:H) confirms that exploitation is constrained to adjacent network access with high-privilege credentials, yet the integrity impact on the vulnerable system is rated High. No public exploit code exists (SSVC: Exploitation none; CVSS E:U), and NETGEAR has released firmware patches for all affected product lines.
Insufficient input validation across three NETGEAR router models - R7000, RAXE500, and RS700 - permits authenticated administrators with adjacent network access to make unauthorized modifications to router software and core functionality beyond what their role should allow. The flaw is classified as CWE-20 and carries a CVSS 4.0 score of 4.3, constrained to local-network, high-privilege attack scenarios with no observed public exploitation. NETGEAR has self-reported the issue and published patch resources via product-specific support pages; no public exploit code has been identified at time of analysis.
Command injection in NETGEAR Nighthawk routers and mesh systems (spanning MR, MS, RAX, RS, and XR series) enables a network-adjacent attacker who has achieved a man-in-the-middle position on the local network to compromise device confidentiality and integrity. Exploitation requires intercepting and modifying local network traffic, making this a high-complexity, adjacency-constrained attack. No public exploit code or active exploitation has been identified at time of analysis, and NETGEAR has released per-model firmware patches.
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authenticated administrators on the local network to manipulate device configuration beyond intended boundaries, classified under CWE-15 (External Control of System or Configuration Setting). The CVSS 4.0 vector (AV:A/PR:H/VI:H) confirms that exploitation is constrained to adjacent network access with high-privilege credentials, yet the integrity impact on the vulnerable system is rated High. No public exploit code exists (SSVC: Exploitation none; CVSS E:U), and NETGEAR has released firmware patches for all affected product lines.