CVE-2025-50526

The vulnerability (CWE-77) consists of improper neutralization of special characters passed to the switch_status function, which subsequently executes them as system commands. An attacker can send a crafted network request containing a malicious payload without the need to possess any access credentials. The attack vector is network-based, requires no user interaction or special privileges, making it exceptionally dangerous.

An attacker can execute arbitrary system commands on the device with potentially the highest privileges, leading to complete compromise of the device's confidentiality, integrity, and availability — including the ability to permanently modify network configuration or use the device as an entry point to the internal network.

Apply patches available from the manufacturer according to the references. Until an update is applied, it is recommended to isolate the device management panel from public network access and restrict access to the administrative interface only to trusted hosts.

Netgear EX8000 (Wi-Fi range extender) with firmware version V1.0.0.126