PT-2017-3172 · NetGear · Netgear Wnr2000V5 Router

Pedro Ribeiro · Published 2017-01-29 · Updated 2025-01-27 · CVE-2016-10174

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR WNR2000v5 Router (affected versions not specified)

Description The issue is caused by a buffer overflow in the hidden lang avi parameter when invoking the URL "/apply.cgi?/lang check.html". This can be exploited by an unauthenticated attacker to achieve remote code execution.

Recommendations As a temporary workaround, consider disabling access to the "/apply.cgi?/lang check.html" endpoint until a patch is available. Restrict the use of the hidden lang avi parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2017-02584

CVE-2016-10174

Affected Products

Netgear Wnr2000V5 Router

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_wnr2000_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40949 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Dec/72 · Exploit
• 🔥 https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt · Exploit
• 🔥 https://exploit-db.com/exploits/41719 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10174 · Security Note
• http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02584 · Security Note
• https://t.me/cvenotify/108747 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• http://securityfocus.com/bid/95867 · Note