Actively exploited · Published Feb 22, 2017 · Assigned by mitre

CVE-2017-6077

Critical 9.8 Exploited

In plain English

A critical-severity OS command injection in Wireless Router DGN2200 from NETGEAR. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2022). The chance it is exploited in the next 30 days is estimated at 68.7% (higher than 99.3% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)68.7%top 0.7% of all CVEs

Exploited in the wildYesCISA KEV since Mar 7, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 7, 2022.

Official description

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

96408 vdb-entry, x_refsource_BID
41394 exploit, x_refsource_EXPLOIT-DB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6077 government-resource