Skip to content

CVE-2017-6077 ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST...

CriticalCVSS 9.8 EPSS 68.7% CISA KEV added 2022-03-07 · due 2022-09-07 Exploited in the wild
Published
Updated
Exploit status
Exploited in the wild (confirmed)
Sign in for asset impact Search another CVE

Description

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

CISA Known Exploited Vulnerability

Date added
2022-03-07
Due date (FCEB)
2022-09-07
Ransomware use
Unknown

Required action

Apply updates per vendor instructions.

Affected products

ProductAffected versionsFixed in
netgear dgn2200 firmware <= 10.0.0.50 No fix listed

References

  • 96408 broken-link third-party-advisory vdb-entry
  • 41394 exploit third-party-advisory vdb-entry
  • www.cisa.gov government-resource us-government-resource