NETGEAR DGN2200 Devices OS Command Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25
• EPSS: 73% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

CISA: dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Apr 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• www.securityfocus.com/bid/96463Broken LinkThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/41459ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/41472ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/42257ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource