High severity · published Mar 15, 2017
CVE-2017-6366
Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users…
8.8
CVSS
3.5%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi. NOTE: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dgn2200 Firmware · Netgear
through 10.0.0.50 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6366
Third Party Advisory
https://www.exploit-db.com/exploits/41472/
More from Dgn2200 Firmware
9.8
CVE-2017-6077
NETGEAR DGN2200 Remote Code Execution Vulnerability
9.8
CVE-2021-38516
Certain NETGEAR devices are affected by lack of access control at the function level
9.8
CVE-2019-17373
Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL
9.8
CVE-2016-5649
A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a…
8.8
CVE-2025-12944
Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with direct network access to the device to potentially execute code on the…