CVE-2016-10174
critical · 9.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2022-03-25Remediation due 2022-04-15
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
9.8
CVSS
83.3%
EPSS (exploit prob.)
100th
EPSS percentile
2017-01-30
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-120
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| netgear | d6100_firmware | all versions |
| netgear | d6100 | all versions |
| netgear | d7000_firmware | all versions |
| netgear | d7000 | all versions |
| netgear | d7800_firmware | all versions |
| netgear | d7800 | all versions |
| netgear | jnr1010v2_firmware | all versions |
| netgear | jnr1010v2 | all versions |
| netgear | jnr3300_firmware | all versions |
| netgear | jnr3300 | all versions |
| netgear | jwnr2010v5_firmware | all versions |
| netgear | jwnr2010v5 | all versions |
| netgear | r2000_firmware | all versions |
| netgear | r2000 | all versions |
| netgear | r6100_firmware | all versions |
| netgear | r6100 | all versions |
| netgear | r6220_firmware | all versions |
| netgear | r6220 | all versions |
| netgear | r7500_firmware | all versions |
| netgear | r7500 | all versions |
| netgear | r7500v2_firmware | all versions |
| netgear | r7500v2 | all versions |
| netgear | wndr3700v4_firmware | all versions |
| netgear | wndr3700v4 | all versions |
| netgear | wndr3800_firmware | all versions |
| netgear | wndr3800 | all versions |
| netgear | wndr4300_firmware | all versions |
| netgear | wndr4300 | all versions |
| netgear | wndr4300v2_firmware | all versions |
| netgear | wndr4300v2 | all versions |
| netgear | wndr4500v3_firmware | all versions |
| netgear | wndr4500v3 | all versions |
| netgear | wndr4700_firmware | all versions |
| netgear | wndr4700 | all versions |
| netgear | wnr1000v2_firmware | all versions |
| netgear | wnr1000v2 | all versions |
| netgear | wnr1000v4_firmware | all versions |
| netgear | wnr1000v4 | all versions |
| netgear | wnr2000v3_firmware | all versions |
| netgear | wnr2000v3 | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
- http://seclists.org/fulldisclosure/2016/Dec/72
- http://www.securityfocus.com/bid/95867
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
- https://www.exploit-db.com/exploits/40949/
- https://www.exploit-db.com/exploits/41719/
- http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
- http://seclists.org/fulldisclosure/2016/Dec/72
- http://www.securityfocus.com/bid/95867
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
- https://www.exploit-db.com/exploits/40949/
- https://www.exploit-db.com/exploits/41719/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2016-10174