NETGEAR · Wireless Access Point (WAP) Devices
CVE-2016-1555
NETGEAR Multiple WAP Devices Command Injection Vulnerability
What it is
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
CISA: Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 15, 2022
More exploited flaws from NETGEAR
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 8, 2022 | Exposure of Sensitive Information | Multiple Devices | High 8.1 | 89% |
| Jun 8, 2022 | Buffer Overflow | Multiple Devices | Critical 9.8 | 46% |
| Mar 25, 2022 | OS Command Injection | DGN2200 Devices | High 8.8 | 73% |
| Mar 25, 2022 | Buffer Overflow | WNR2000v5 Router | Critical 9.8 | 83% |
| Mar 7, 2022 | Remote Code Execution | Multiple Routers | High 8.8 | 99.8% |
| Mar 7, 2022 | DGN2200 Remote Code Execution | Wireless Router DGN2200 | Critical 9.8 | 69% |
| Nov 3, 2021 | Missing Function Level Access Control | JGS516PE Devices | Critical 9.8 | 57% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.