CVE-2026-107917: CWE-20 Improper input validation in NETGEAR R7300DST

This vulnerability arises from insufficient input validation in the PPPoE Setup feature of the NETGEAR R7300DST router. Authenticated administrators connected locally can exploit this flaw to perform unauthorized actions on the router. The vulnerability was identified through testing in a controlled research environment using a simulated version of the router's software; it has not been confirmed on physical production devices. The affected firmware versions are from 0 through 1.0.0.74 inclusive. The CVSS 4.0 vector indicates the attack requires local access with high privileges but no user interaction, and the impact is limited to the integrity of the device.

An authenticated administrator on the local network can leverage this vulnerability to perform unauthorized actions on the router. Since the vulnerability affects the PPPoE Setup feature, it could potentially allow manipulation of network configuration or other administrative functions. However, the issue has only been demonstrated in a simulated environment and not confirmed on physical devices. The CVSS score of 4.3 reflects a medium severity impact primarily affecting integrity.

No official patch or fix information is provided. Since the vulnerability requires authenticated administrator access on the local network, limiting administrative access to trusted users and networks can reduce risk. Monitor NETGEAR advisories for any forthcoming patches or updates addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.