Critical severity · published Jan 30, 2017
CVE-2016-10176
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device
9.8
CVSS
77.4%
EPSS
No
On KEV
Description
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)77.4% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wnr2000v5 Firmware · Netgear
through 1.0.0.34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-10176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-10176
Patch
http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
Exploit
http://seclists.org/fulldisclosure/2016/Dec/72
Third Party Advisory
http://www.securityfocus.com/bid/95867
Exploit
https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
www.exploit-db.com
https://www.exploit-db.com/exploits/40949/
More from Wnr2000v5 Firmware
9.8
CVE-2016-10174
NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
9.8
CVE-2021-45658
Certain NETGEAR devices are affected by server-side injection
9.8
CVE-2021-45619
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
9.8
CVE-2021-45618
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
9.8
CVE-2020-35799
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker