NETGEAR · DGN2200 Devices
CVE-2017-6334
NETGEAR DGN2200 Devices OS Command Injection Vulnerability
Nedir
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
CISA: dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
Ne yapmalı
The impacted product is end-of-life and should be disconnected if still in use.
ABD federal kurumları için son tarih: 15 Nisan 2022
NETGEAR için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 8 Eyl 2022 | Exposure of Sensitive Information | Multiple Devices | Yüksek 8,1 | 89% |
| 8 Haz 2022 | Buffer Overflow | Multiple Devices | Kritik 9,8 | 46% |
| 25 Mar 2022 | Multiple WAP Devices Command Injection | Wireless Access Point (WAP) Devices | Kritik 9,8 | 98% |
| 25 Mar 2022 | Buffer Overflow | WNR2000v5 Router | Kritik 9,8 | 83% |
| 7 Mar 2022 | Remote Code Execution | Multiple Routers | Yüksek 8,8 | 99,8% |
| 7 Mar 2022 | DGN2200 Remote Code Execution | Wireless Router DGN2200 | Kritik 9,8 | 69% |
| 3 Kas 2021 | Missing Function Level Access Control | JGS516PE Devices | Kritik 9,8 | 57% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.