This vulnerability (CVE-2026-0420) arises from an improper implementation of TLS certificate validation in the ReadyCloud client application used with the NETGEAR RAX120v1 device. The weakness corresponds to CWE-325 (Missing Cryptographic Step), which can allow an attacker to intercept and potentially manipulate communications by performing a man-in-the-middle attack. The CVSS 4.6 score reflects a medium severity with network attack vector, high complexity, and partial impact on confidentiality. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to perform man-in-the-middle attacks, potentially compromising the confidentiality of data transmitted between the client app and the device. There is no indication of impact on integrity or availability. The vulnerability requires high attack complexity and partial attacker privileges are not needed. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when using the ReadyCloud client app with the affected device. No vendor-provided mitigation or temporary fix is currently documented.