Authenticated stored XSS affecting router administration

Stored XSS in NETGEAR Orbi routers before listed firmware versions allows remote authenticated users to execute scripts through the administration interface. The vendor advisory does not disclose the specific field, endpoint, or sanitization failure that stores and later renders attacker-controlled markup. Exploitation requires authenticated access to the router administration interface and a victim administrator to view the poisoned content, enabling script execution in that administrative context without a reported device reboot or shutdown.