CVE-2016-10174 KEV EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 83.3% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2022-04-15.
Description
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 83.33% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-120 |
| On CISA KEV | yes — remediate by 2022-04-15 |
| Public exploit | yes |
| Published | 2017-01-30 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability |
|---|---|
| Added | 2022-03-25 |
| Due | 2022-04-15 |
| Vendor / product | NETGEAR / WNR2000v5 Router |
| Ransomware use | none reported |
Affected (40)
| Vendor | Product |
|---|---|
| netgear | d6100 |
| netgear | d6100 firmware |
| netgear | d7000 |
| netgear | d7000 firmware |
| netgear | d7800 |
| netgear | d7800 firmware |
| netgear | jnr1010v2 |
| netgear | jnr1010v2 firmware |
| netgear | jnr3300 |
| netgear | jnr3300 firmware |
| netgear | jwnr2010v5 |
| netgear | jwnr2010v5 firmware |
| netgear | r2000 |
| netgear | r2000 firmware |
| netgear | r6100 |
| netgear | r6100 firmware |
| netgear | r6220 |
| netgear | r6220 firmware |
| netgear | r7500 |
| netgear | r7500 firmware |
| netgear | r7500v2 |
| netgear | r7500v2 firmware |
| netgear | wndr3700v4 |
| netgear | wndr3700v4 firmware |
| netgear | wndr3800 |
| netgear | wndr3800 firmware |
| netgear | wndr4300 |
| netgear | wndr4300 firmware |
| netgear | wndr4300v2 |
| netgear | wndr4300v2 firmware |
| netgear | wndr4500v3 |
| netgear | wndr4500v3 firmware |
| netgear | wndr4700 |
| netgear | wndr4700 firmware |
| netgear | wnr1000v2 |
| netgear | wnr1000v2 firmware |
| netgear | wnr1000v4 |
| netgear | wnr1000v4 firmware |
| netgear | wnr2000v3 |
| netgear | wnr2000v3 firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Netgear WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit) | 2017-03-24 |
| exploit-db | Netgear WNR2000v5 - Remote Code Execution | 2016-12-21 |
References
- http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
- http://seclists.org/fulldisclosure/2016/Dec/72
- http://www.securityfocus.com/bid/95867
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
- https://www.exploit-db.com/exploits/40949/
- https://www.exploit-db.com/exploits/41719/
- http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
- http://seclists.org/fulldisclosure/2016/Dec/72
- http://www.securityfocus.com/bid/95867
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
- https://www.exploit-db.com/exploits/40949/
- https://www.exploit-db.com/exploits/41719/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174
→ the Explorer · watch your stack · NVD