Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-10176

CWE-20 — Improper Input Validation5 documents5 sources
Severity
9.8CRITICAL
EPSS
86.6%
top 0.58%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Netgear Wnr2000v5 Firmware
Timeline
PublishedJan 30
Latest updateMay 17

Description

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) a…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

Patches

Patch: kb.netgear.com ↗Patch: kb.netgear.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-pqfp-vjxq-57m3: The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply↗2022-05-17
▶
CVEList
CVE-2016-10176: The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply↗2017-01-30
▶
VulnCheck
NETGEAR wnr2000v5_firmware Improper Input Validation↗2016
▶

💥Exploits & PoCs

1
Exploit-DB
Netgear WNR2000v5 - Remote Code Execution↗2016-12-21
▶
CVE-2016-10176 (CRITICAL CVSS 9.8) | The NETGEAR WNR2000v5 router allows | cvebase.io