Published: 30/01/2017 Updated: 03/09/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated malicious user to achieve remote code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
netgear wnr2000v5_firmware

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' require 'time' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::CRand def initialize(info = { ...

# # Remote code execution in NETGEAR WNR2000v5 # - by Pedro Ribeiro (pedrib@gmailcom) / Agile Information Security # Released on 20/12/2016 # # NOTE: this exploit is "alpha" quality and has been deprecated Please see the modules # accepted into the Metasploit framework, or githubcom/pedrib/PoC/tree/master/exploits/metasploit/wnr2000 # # ...

CWE-119 https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt http://seclists.org/fulldisclosure/2016/Dec/72 http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability http://www.securityfocus.com/bid/95867 https://www.exploit-db.com/exploits/41719/https://www.exploit-db.com/exploits/40949/https://nvd.nist.gov https://www.exploit-db.com/exploits/41719/

CVE-2016-10174

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect