CVE-2016-10174
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - cve@mitre.org
- Published
- 2017-01-30
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2022-03-25, action due 2022-04-15: Apply updates per vendor instructions.
- Weaknesses
- CWE-120
Affected products
- D6100 Firmware (Netgear)
- D7000 Firmware (Netgear)
- D7800 Firmware (Netgear)
- Jnr1010v2 Firmware (Netgear)
- Jnr3300 Firmware (Netgear)
- Jwnr2010v5 Firmware (Netgear)
- R2000 Firmware (Netgear)
- R6100 Firmware (Netgear)
- R6220 Firmware (Netgear)
- R7500 Firmware (Netgear)
- R7500v2 Firmware (Netgear)
- Wndr3700v4 Firmware (Netgear)
- Wndr3800 Firmware (Netgear)
- Wndr4300 Firmware (Netgear)
- Wndr4300v2 Firmware (Netgear)
- Wndr4500v3 Firmware (Netgear)
- Wndr4700 Firmware (Netgear)
- Wnr1000v2 Firmware (Netgear)
- Wnr1000v4 Firmware (Netgear)
- Wnr2000v3 Firmware (Netgear)
- Wnr2000v4 Firmware (Netgear)
- Wnr2000v5 Firmware (Netgear)
- Wnr2020 Firmware (Netgear)
- Wnr2050 Firmware (Netgear)
- Wnr2200 Firmware (Netgear)
- Wnr2500 Firmware (Netgear)
- Wnr614 Firmware (Netgear)
- Wnr618 Firmware (Netgear)
References
- http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
- http://seclists.org/fulldisclosure/2016/Dec/72
- http://www.securityfocus.com/bid/95867
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
- https://www.exploit-db.com/exploits/40949/
- https://www.exploit-db.com/exploits/41719/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174
