Skip to content

CVE-2017-6334 dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP P...

HighCVSS 8.8 EPSS 72.6% CISA KEV added 2022-03-25 · due 2022-04-15 Exploited in the wild Framework module Public exploit
Published
Updated
Exploit status
Exploited in the wild (confirmed)
Sign in for asset impact Search another CVE

Description

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

CISA Known Exploited Vulnerability

Date added
2022-03-25
Due date (FCEB)
2022-04-15
Ransomware use
Unknown

Required action

The impacted product is end-of-life and should be disconnected if still in use.

Affected products

ProductAffected versionsFixed in
netgear dgn2200 series firmware <= 10.0.0.50 No fix listed

References

  • 96463 broken-link third-party-advisory vdb-entry
  • 41459 exploit third-party-advisory vdb-entry
  • 41472 exploit third-party-advisory vdb-entry
  • 42257 exploit third-party-advisory vdb-entry
  • www.cisa.gov government-resource us-government-resource