Login Request a demo
High severity · published Apr 28, 2020
CVE-2016-11057
Certain NETGEAR devices are affected by mishandling of repeated URL calls
7.5
CVSS
1%
EPSS
No
On KEV
Description
Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2020v2 before 2017-01-06, R6220 before 2017-01-06, and WNDR3700v5 before 2017-01-06.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JF
Jnr1010 Firmware · Netgear
before 2017-01-06 · source: NVD
JF
Jwnr2000 Firmware · Netgear
before 2017-01-06 · source: NVD
JF
Jwnr2010 Firmware · Netgear
before 2017-01-06 · source: NVD
RF
R6220 Firmware · Netgear
before 2017-01-06 · source: NVD
WF
Wndr3700 Firmware · Netgear
before 2017-01-06 · source: NVD
WF
Wnr1000 Firmware · Netgear
before 2017-01-06 · source: NVD
WF
Wnr2020 Firmware · Netgear
before 2017-01-06; before 2017-01-06 · source: NVD
WF
Wnr614 Firmware · Netgear
before 2017-01-06 · source: NVD
WF
Wnr618 Firmware · Netgear
before 2017-01-06 · source: NVD
Affected product
JF
Jnr1010 Firmware
Netgear
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-11057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-11057
Vendor Advisory
https://kb.netgear.com/29960/NETGEAR-Product-Vulnerability-Advisory-Potential-security-issue-associated-with-remote-management
More from Jnr1010 Firmware
9.8
CVE-2016-11014
NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case
8.8
CVE-2018-21226
Certain NETGEAR devices are affected by authentication bypass
8.8
CVE-2018-21169
Certain NETGEAR devices are affected by incorrect configuration of security settings
8.8
CVE-2017-18703
Certain NETGEAR devices are affected by CSRF
8.8
CVE-2017-18737
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker