high8.8Known exploitedPublic exploit code
CVE-2017-6334
NETGEAR DGN2200 Devices OS Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.
The impacted product is end-of-life and should be disconnected if still in use.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Netgear DGN2200 - 'dnslookup.cgi' Command Injection (Metasploit)2017-06-26 · remote · cgi · Verified
- Netgear DGN2200v1/v2/v3/v4 - 'dnslookup.cgi' Remote Command Execution2017-02-25 · webapps · hardware · Verified
- Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery2017-02-28 · webapps · hardware
Impact
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netgear | Dgn2200 Series Firmware | through 10.0.0.50 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://www.securityfocus.com/bid/96463
- https://www.exploit-db.com/exploits/41459/
- https://www.exploit-db.com/exploits/41472/
- https://www.exploit-db.com/exploits/42257/
- http://www.securityfocus.com/bid/96463
- https://www.exploit-db.com/exploits/41459/
- https://www.exploit-db.com/exploits/41472/
- https://www.exploit-db.com/exploits/42257/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6334