9.8Kritik
KEV
CVE-2016-10174NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
Aktif olarak istismar ediliyor — NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.04.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-10174
Açıklama
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
Zayıflık türü (CWE):
CWE-120
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- http://seclists.org/fulldisclosure/2016/Dec/72 ExploitMailing ListThird Party AdvisoryVDB Entry
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt ExploitTechnical DescriptionThird Party Advisory
- 95867 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 41719 exploitExploitThird Party AdvisoryVDB Entry
- http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability Vendor Advisory
- 40949 exploitExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174 US Government Resource
CPE eşleşmeleri (NVD) (28)
cpe:2.3:o:netgear:d6100_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:d7000_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:d7800_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:jnr1010v2_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:jnr3300_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:jwnr2010v5_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:r2000_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:r6100_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:r6220_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:r7500_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:r7500v2_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wndr3700v4_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wndr3800_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wndr4300_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wndr4300v2_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wndr4500v3_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wndr4700_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr1000v2_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr1000v4_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr2000v3_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr2000v4_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr2000v5_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr2020_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr2050_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr2200_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr2500_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr614_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netgear:wnr618_firmware:-:*:*:*:*:*:*:*