CVE-2016-10174KEV · OVERDUE

NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

Critical · published January 30, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.

1651
days past CISA
deadline
CVSS v3.1
9.8
EPSS
83%
Percentile
99.7
In the wild
Confirmed
What it is

🚨 A sneaky buffer overflow in the NETGEAR WNR2000v5 lets attackers execute code from afar, all through a hidden parameter! 🔥 Think of this like a restaurant where an unsuspecting customer finds a way to slip a note to the chef without anyone noticing, allowing them to change the entire menu. That’s how easily this router can be compromised! An unauthenticated attacker could walk right in and take control of your network, modifying settings, accessing sensitive data, or even spying on your online activities. This vulnerability is not just a minor irritation; it’s a potential gateway to full remote access, making your digital life absolutely vulnerable!

Put simply

Think of this like a restaurant where an unsuspecting customer finds a way to slip a note to the chef without anyone noticing, allowing them to change the entire menu. That’s how easily this router can be compromised! The vulnerability arises from a buffer overflow in the router's 'hidden_lang_avi' parameter when accessing the URL '/apply.cgi?/lang_check.html', allowing attackers to execute arbitrary code remotely without needing any authentication.

What to do

An unauthenticated attacker could walk right in and take control of your network, modifying settings, accessing sensitive data, or even spying on your online activities. This vulnerability is not just a minor irritation; it’s a potential gateway to full remote access, making your digital life absolutely vulnerable! Update your NETGEAR WNR2000v5 router to the latest firmware version immediately. Disable remote management features if not needed, and consider changing default settings to protect your network further. 🛡️ You’ve got this! With these steps, you can secure your network and thwart those pesky attackers! 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.83328 · 99.7th percentile
Published
2017-01-30T04:24Z
KEV added
2022-03-25 · due 2022-04-15
EPSS history
Timeline
  • 25 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 15
    kev
  • 30 JAN 04:24Z
    The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html
    cvelistv5