Thanks for sharing. I am not competent to give a comprehensive analysis, but it appears to me that (a) these vulnerabilities require either physical access to the Orbi units or guessing the WiFi password, and (b) Netgear has addressed some of these concerns in firmware releases. (without spelling out what they did or giving credit) I am much more concerned with external vulnerabilities, which the Orbi platform appears to repulse much as most consumer WiFi routers: i.e. do not accept connections.
This is another case where it would be really nice if someone at Netgear participated in these community forums. Alas, in the past four years, I cannot recall seeing a post by anyone claiming to be a Netgear engineer or support person.
