[ CVE-2017-6862 · Published 26 May 2017 ]
NETGEAR Multiple Devices Buffer Overflow Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 46%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-08
- EPSS: 46% chance of exploitation in the next 30 days (higher than 99% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.
CISA: Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 22 Jun 2022): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- www.securityfocus.com/bid/98740Broken LinkThird Party AdvisoryVDB Entry
- kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on…Vendor Advisory
- www.on-x.com/sites/default/files/on-x_-_security_advisory_-_netgear_wnr2000v5_-_cve-201…Broken Link
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource