NETGEAR · Wireless Router DGN2200
CVE-2017-6077
NETGEAR DGN2200 Remote Code Execution Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: 69%
What it is
ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.
CISA: NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 7, 2022
More exploited flaws from NETGEAR
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 8, 2022 | Exposure of Sensitive Information | Multiple Devices | High 8.1 | 89% |
| Jun 8, 2022 | Buffer Overflow | Multiple Devices | Critical 9.8 | 46% |
| Mar 25, 2022 | Multiple WAP Devices Command Injection | Wireless Access Point (WAP) Devices | Critical 9.8 | 98% |
| Mar 25, 2022 | OS Command Injection | DGN2200 Devices | High 8.8 | 73% |
| Mar 25, 2022 | Buffer Overflow | WNR2000v5 Router | Critical 9.8 | 83% |
| Mar 7, 2022 | Remote Code Execution | Multiple Routers | High 8.8 | 99.8% |
| Nov 3, 2021 | Missing Function Level Access Control | JGS516PE Devices | Critical 9.8 | 57% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.