Actively exploited · Published Mar 6, 2017 · Assigned by mitre

CVE-2017-6334

High 8.8 Exploited

In plain English

A high-severity OS command injection in DGN2200 Devices from NETGEAR. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 72.6% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)72.6%top 0.6% of all CVEs

Exploited in the wildYesCISA KEV since Mar 25, 2022

Attack tooling1Metasploit

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Apr 15, 2022.

Official description

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

96463 vdb-entry, x_refsource_BID
41459 exploit, x_refsource_EXPLOIT-DB
41472 exploit, x_refsource_EXPLOIT-DB
42257 exploit, x_refsource_EXPLOIT-DB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6334 government-resource