important · Boot chain
Orbi RBx850 recovery can persist a boot command that runs unsigned firmware.
Affects
Netgear Orbi RBR850 routers and RBS850 satellites sold in RBK852 through RBK855 mesh kits.
The public OpenWrt implementation uses an NMRP-flashed factory image and embedded U-Boot script to replace the stock signed-image boot path persistently.
Detail and 2 sources
It requires gigabit LAN access while an RBR850 or RBS850 is power-cycled into recovery.