10

CVE-2016-10174

Warnung
Exploit
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netgear ≫ D6100 Firmware Version -
   Netgear ≫ D6100 Version -
Netgear ≫ D7000 Firmware Version -
   Netgear ≫ D7000 Version -
Netgear ≫ D7800 Firmware Version -
   Netgear ≫ D7800 Version -
Netgear ≫ Jnr1010v2 Firmware Version -
   Netgear ≫ Jnr1010v2 Version -
Netgear ≫ Jnr3300 Firmware Version -
   Netgear ≫ Jnr3300 Version -
Netgear ≫ Jwnr2010v5 Firmware Version -
   Netgear ≫ Jwnr2010v5 Version -
Netgear ≫ R2000 Firmware Version -
   Netgear ≫ R2000 Version -
Netgear ≫ R6100 Firmware Version -
   Netgear ≫ R6100 Version -
Netgear ≫ R6220 Firmware Version -
   Netgear ≫ R6220 Version -
Netgear ≫ R7500 Firmware Version -
   Netgear ≫ R7500 Version -
Netgear ≫ R7500v2 Firmware Version -
   Netgear ≫ R7500v2 Version -
Netgear ≫ Wndr3700v4 Firmware Version -
   Netgear ≫ Wndr3700v4 Version -
Netgear ≫ Wndr3800 Firmware Version -
   Netgear ≫ Wndr3800 Version -
Netgear ≫ Wndr4300 Firmware Version -
   Netgear ≫ Wndr4300 Version -
Netgear ≫ Wndr4300v2 Firmware Version -
   Netgear ≫ Wndr4300v2 Version -
Netgear ≫ Wndr4500v3 Firmware Version -
   Netgear ≫ Wndr4500v3 Version -
Netgear ≫ Wndr4700 Firmware Version -
   Netgear ≫ Wndr4700 Version -
Netgear ≫ Wnr1000v2 Firmware Version -
   Netgear ≫ Wnr1000v2 Version -
Netgear ≫ Wnr1000v4 Firmware Version -
   Netgear ≫ Wnr1000v4 Version -
Netgear ≫ Wnr2000v3 Firmware Version -
   Netgear ≫ Wnr2000v3 Version -
Netgear ≫ Wnr2000v4 Firmware Version -
   Netgear ≫ Wnr2000v4 Version -
Netgear ≫ Wnr2000v5 Firmware Version -
   Netgear ≫ Wnr2000v5 Version -
Netgear ≫ Wnr2020 Firmware Version -
   Netgear ≫ Wnr2020 Version -
Netgear ≫ Wnr2050 Firmware Version -
   Netgear ≫ Wnr2050 Version -
Netgear ≫ Wnr2200 Firmware Version -
   Netgear ≫ Wnr2200 Version -
Netgear ≫ Wnr2500 Firmware Version -
   Netgear ≫ Wnr2500 Version -
Netgear ≫ Wnr614 Firmware Version -
   Netgear ≫ Wnr614 Version -
Netgear ≫ Wnr618 Firmware Version -
   Netgear ≫ Wnr618 Version -

25.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

Schwachstelle

The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 83.45% 0.996
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
Vendor Advisory
http://seclists.org/fulldisclosure/2016/Dec/72
Third Party Advisory
Exploit
VDB Entry
Mailing List
http://www.securityfocus.com/bid/95867
Third Party Advisory
Broken Link
VDB Entry
https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
Third Party Advisory
Exploit
Technical Description
https://www.exploit-db.com/exploits/40949/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/41719/
Third Party Advisory
Exploit
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174
US Government Resource