CVE-2016-1555

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-03-25Remediation due 2022-04-15

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

9.8

CVSS

98.3%

EPSS (exploit prob.)

100th

EPSS percentile

2017-04-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
netgear	wnap320_firmware	<= 3.0.5.0
netgear	wnap320	all versions
netgear	wndap350_firmware	<= 3.0.5.0
netgear	wndap350	all versions
netgear	wndap360_firmware	<= 3.0.5.0
netgear	wndap360	all versions
netgear	wndap210v2_firmware	<= 3.0.5.0
netgear	wndap210v2	all versions
netgear	wn604_firmware	<= 3.3.2
netgear	wn604	all versions
netgear	wndap660_firmware	<= 3.0.5.0
netgear	wndap660	all versions
netgear	wn802tv2_firmware	<= 3.0.5.0
netgear	wn802tv2	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-1555