CVE-2016-10175
published 2017-01-30CVE-2016-10175: The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain…
PriorityP274critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
64.98%
99.2th percentile
The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | wnr2000v5_firmware | <= 1.0.0.34 | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Netgear WNR2000v5 Possible Serial Number Leak"; flow:established,to_server; http.uri; content:"/BRS_netgear_success.html"; nocase; reference:cve,2016-10175; reference:url,cve.circl.lu/cve/CVE-2016-10175; classtype:attempted-recon; sid:2023830; rev:4; metadata:affected_product Netgear_Router, attack_target Client_Endpoint, created_at 2017_02_02, cve CVE_2016_10175, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2024_03_07;)
- →Detect unauthenticated GET requests to /BRS_netgear_success.html — this is the serial number leak endpoint used as the first step of the exploit chain. ↗
- →Detect POST to /apply_noauth.cgi with body containing submit_flag=match_sn — this is the unauthenticated serial number submission step of password recovery abuse. ↗
- →Detect rapid sequential POST requests to /apply_noauth.cgi with a timestamp= parameter in the query string — this is the brute-force timestamp enumeration used to bypass authentication. ↗
- →Detect the serial number pattern in HTTP response bodies via regex var sn="([\w]*)"; — presence indicates the router is leaking its serial number. ↗
- →Detect WWW-Authenticate header containing 'WNR2000v5' — used by the exploit to fingerprint the vulnerable device before attacking. ↗
- →Detect the telnetenable secret key pattern 'AMBIT_TELNET_ENABLE+' in network traffic — this is used to craft the Blowfish-encrypted telnet enable payload. ↗
- →Detect unexpected TCP connections to port 23 on the router after exploit activity — successful exploitation spawns a root shell via utelnetd on port 23. ↗
- ·The timestamp brute-force window is configurable: 5000 seconds back with reboot, 500000 seconds without reboot. Detection rules based on request rate should account for the slower no-reboot variant. ↗
- ·The exploit was tested against firmware versions 1.0.0.34 and 1.0.0.18 of the WNR2000v5, and may also work against hardware revisions v3 and v4, broadening the affected device scope. ↗
- ·The exploit chain requires CVE-2016-10176 in combination with CVE-2016-10175 to fully recover credentials — detection should correlate both the serial number leak and the security question reset requests. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Netgear WNR2000v5 BRS_netgear_success.html Serial information disclosure (EDB-40949 / ID 11760)
vuldb·2026-05-16·CVSS 9.8
CVE-2016-10175 [CRITICAL] Netgear WNR2000v5 BRS_netgear_success.html Serial information disclosure (EDB-40949 / ID 11760)
A vulnerability described as problematic has been identified in Netgear WNR2000v5. Affected by this issue is some unknown functionality of the file /BRS_netgear_success.html. Executing a manipulation can lead to information disclosure (Serial).
This vulnerability is tracked as CVE-2016-10175. The attack can be launched remotely. Moreover, an exploit is present.
The application of restrictive firewalling is recommended.
GHSA
GHSA-ghhf-xp94-4ggw: The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success
ghsa_unreviewed·2022-05-17·CVSS 9.8
CVE-2016-10175 [CRITICAL] CWE-200 GHSA-ghhf-xp94-4ggw: The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success
The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.
Suricata
ET WEB_SPECIFIC_APPS Netgear WNR2000v5 Possible Serial Number Leak
suricata·2017-02-02·CVSS 9.8
CVE-2016-10175 [CRITICAL] ET WEB_SPECIFIC_APPS Netgear WNR2000v5 Possible Serial Number Leak
ET WEB_SPECIFIC_APPS Netgear WNR2000v5 Possible Serial Number Leak
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Netgear WNR2000v5 Possible Serial Number Leak"; flow:established,to_server; http.uri; content:"/BRS_netgear_success.html"; nocase; reference:cve,2016-10175; reference:url,cve.circl.lu/cve/CVE-2016-10175; classtype:attempted-recon; sid:2023830; rev:4; metadata:affected_product Netgear_Router, attack_target Client_Endpoint, created_at 2017_02_02, cve CVE_2016_10175, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2024_03_07;)
Exploit-DB
Netgear WNR2000v5 - Remote Code Execution
exploitdb·2016-12-21
CVE-2016-10176 Netgear WNR2000v5 - Remote Code Execution
Netgear WNR2000v5 - Remote Code Execution
---
#
# Remote code execution in NETGEAR WNR2000v5
# - by Pedro Ribeiro ([email protected]) / Agile Information Security
# Released on 20/12/2016
#
# NOTE: this exploit is "alpha" quality and has been deprecated. Please see the modules
# accepted into the Metasploit framework, or https://github.com/pedrib/PoC/tree/master/exploits/metasploit/wnr2000
#
#
# TODO:
# - randomise payload
require 'net/http'
require 'uri'
require 'time'
require 'digest'
require 'openssl'
require 'socket'
####################
# ported from https://git.uclibc.org/uClibc/tree/libc/stdlib/random.c
# and https://git.uclibc.org/uClibc/tree/libc/stdlib/random_r.c
TYPE_3 = 3
BREAK_3 = 128
DEG_3 = 31
SEP_3 = 3
@randtbl =
[
# we omit TYPE_3 from here, not needed
-1726662223, 37
Metasploit
NETGEAR WNR2000v5 Administrator Password Recovery
metasploit
NETGEAR WNR2000v5 Administrator Password Recovery
NETGEAR WNR2000v5 Administrator Password Recovery
The NETGEAR WNR2000 router has a vulnerability in the way it handles password recovery. This vulnerability can be exploited by an unauthenticated attacker who is able to guess the value of a certain timestamp which is in the configuration of the router. Brute forcing the timestamp token might take a few minutes, a few hours, or days, but it is guaranteed that it can be bruteforced. This module works very reliably and it has been tested with the WNR2000v5, firmware versions 1.0.0.34 and 1.0.0.18. It should also work with the hardware revisions v4 and v3, but this has not been tested.
No writeups or analysis indexed.
http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerabilityhttp://seclists.org/fulldisclosure/2016/Dec/72http://www.securityfocus.com/bid/95867https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txthttps://www.exploit-db.com/exploits/40949/http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerabilityhttp://seclists.org/fulldisclosure/2016/Dec/72http://www.securityfocus.com/bid/95867https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txthttps://www.exploit-db.com/exploits/40949/
2017-01-30
Published