CVE-2016-1555 (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WN...
CriticalCVSS 9.8
EPSS 98.3%
CISA KEV
added 2022-03-25 · due 2022-04-15
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-25
- Due date (FCEB)
- 2022-04-15
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netgear wnap320 firmware | <= 3.0.5.0 | No fix listed |
| netgear wndap350 firmware | <= 3.0.5.0 | No fix listed |
| netgear wndap360 firmware | <= 3.0.5.0 | No fix listed |
| netgear wndap210v2 firmware | <= 3.0.5.0 | No fix listed |
| netgear wn604 firmware | <= 3.3.2 | No fix listed |
| netgear wndap660 firmware | <= 3.0.5.0 | No fix listed |
| netgear wn802tv2 firmware | <= 3.0.5.0 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160225 D-Link, Netgear Router Vulnerabiltiies mailing-list third-party-advisory
- kb.netgear.com patch vendor-advisory
- 45909 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource