CVE-2016-10176
published 2017-01-30CVE-2016-10176: The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special…
PriorityP191critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
77.58%
99.5th percentile
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | wnr2000v5_firmware | <= 1.0.0.34 | — |
Detection & IOCsextracted from sources · hover to see the quote
othersubmit_flag=passwd&hidden_enable_recovery=1&Apply=Apply&sysOldPasswd=&sysNewPasswd=&sysConfirmPasswd=&enable_recovery=on&question1=1&answer1=secretanswer1&question2=2&answer2=secretanswer2↗
- →Detect unauthenticated GET requests to /BRS_netgear_success.html — this endpoint leaks the router serial number used to initiate password recovery exploitation. ↗
- →Detect unauthenticated POST requests to /apply_noauth.cgi with URI parameters referencing /PWD_password.htm or /lang_check.html followed by a numeric timestamp parameter — this is the core exploitation pattern for CVE-2016-10176. ↗
- →Detect GET to /passwordrecovered.cgi without prior authentication — this endpoint returns the admin username and password in cleartext after successful exploitation. ↗
- →Detect rapid sequential POST requests to /apply_noauth.cgi with incrementing or decrementing 8-digit timestamp values — this is the brute-force timestamp pattern used to bypass authentication. ↗
- →Detect UDP packets to port 23 containing the magic string 'AMBIT_TELNET_ENABLE+' — this is the Blowfish-ECB encrypted telnetenable payload used to open a root telnet shell post-exploitation. ↗
- →Detect WWW-Authenticate response headers containing 'WNR2000v5', 'WNR2000v4', or 'WNR2000v3' — the exploit uses this to fingerprint vulnerable targets. ↗
- →Detect POST to /apply_noauth.cgi?/reboot_waiting.htm with body submit_flag=reboot&yes=Yes — attacker-triggered reboot to force fresh timestamp generation. ↗
- →Detect process execution of 'utelnetd -d -l /bin/sh' on the router — this is the payload spawned by the buffer overflow exploit to open an unauthenticated root shell. ↗
- ·The timestamp brute-force window is configurable: with a forced reboot the exploit searches 5000 seconds back (TIME_OFFSET=5000); without reboot it searches 500000 seconds back. Detection thresholds should account for this wide range of request volume. ↗
- ·The exploit was confirmed against firmware versions 1.0.0.34 and 1.0.0.18 of the WNR2000v5; hardware revisions v3 and v4 are considered potentially vulnerable but untested. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Netgear WNR2000v5 apply.cgi input validation (EDB-40949 / ID 11760)
vuldb·2026-05-16·CVSS 9.8
CVE-2016-10176 [CRITICAL] Netgear WNR2000v5 apply.cgi input validation (EDB-40949 / ID 11760)
A vulnerability classified as critical has been found in Netgear WNR2000v5. This affects an unknown part of the file apply.cgi. The manipulation leads to improper input validation.
This vulnerability is listed as CVE-2016-10176. The attack may be initiated remotely. In addition, an exploit is available.
It is recommended to apply restrictive firewalling.
GHSA
GHSA-ghhf-xp94-4ggw: The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success
ghsa_unreviewed·2022-05-17·CVSS 9.8
CVE-2016-10175 [CRITICAL] CWE-200 GHSA-ghhf-xp94-4ggw: The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success
The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.
GHSA
GHSA-pqfp-vjxq-57m3: The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply
ghsa_unreviewed·2022-05-17
CVE-2016-10176 [CRITICAL] CWE-20 GHSA-pqfp-vjxq-57m3: The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.
VulnCheck
NETGEAR wnr2000v5_firmware Improper Input Validation
vulncheck·2016·CVSS 9.8
CVE-2016-10176 [CRITICAL] NETGEAR wnr2000v5_firmware Improper Input Validation
NETGEAR wnr2000v5_firmware Improper Input Validation
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.
Affected: NETGEAR wnr2000v5_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation Ref
No detection rules found.
Exploit-DB
Netgear WNR2000v5 - Remote Code Execution
exploitdb·2016-12-21
CVE-2016-10176 Netgear WNR2000v5 - Remote Code Execution
Netgear WNR2000v5 - Remote Code Execution
---
#
# Remote code execution in NETGEAR WNR2000v5
# - by Pedro Ribeiro ([email protected]) / Agile Information Security
# Released on 20/12/2016
#
# NOTE: this exploit is "alpha" quality and has been deprecated. Please see the modules
# accepted into the Metasploit framework, or https://github.com/pedrib/PoC/tree/master/exploits/metasploit/wnr2000
#
#
# TODO:
# - randomise payload
require 'net/http'
require 'uri'
require 'time'
require 'digest'
require 'openssl'
require 'socket'
####################
# ported from https://git.uclibc.org/uClibc/tree/libc/stdlib/random.c
# and https://git.uclibc.org/uClibc/tree/libc/stdlib/random_r.c
TYPE_3 = 3
BREAK_3 = 128
DEG_3 = 31
SEP_3 = 3
@randtbl =
[
# we omit TYPE_3 from here, not needed
-1726662223, 37
Metasploit
NETGEAR WNR2000v5 Administrator Password Recovery
metasploit
NETGEAR WNR2000v5 Administrator Password Recovery
NETGEAR WNR2000v5 Administrator Password Recovery
The NETGEAR WNR2000 router has a vulnerability in the way it handles password recovery. This vulnerability can be exploited by an unauthenticated attacker who is able to guess the value of a certain timestamp which is in the configuration of the router. Brute forcing the timestamp token might take a few minutes, a few hours, or days, but it is guaranteed that it can be bruteforced. This module works very reliably and it has been tested with the WNR2000v5, firmware versions 1.0.0.34 and 1.0.0.18. It should also work with the hardware revisions v4 and v3, but this has not been tested.
No writeups or analysis indexed.
http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerabilityhttp://seclists.org/fulldisclosure/2016/Dec/72http://www.securityfocus.com/bid/95867https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txthttps://www.exploit-db.com/exploits/40949/http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerabilityhttp://seclists.org/fulldisclosure/2016/Dec/72http://www.securityfocus.com/bid/95867https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txthttps://www.exploit-db.com/exploits/40949/
2017-01-30
Published
Exploited in the wild