⚠ Actively exploited
Added to CISA KEV on 2022-03-25. Federal agencies required to patch by 2022-04-15. Required action: Apply updates per vendor instructions..

CVE-2016-1555

CWE-77 — Command Injection8 documents8 sources
Severity
9.8CRITICAL
EPSS
94.3%
top 0.05%
CISA KEV
KEV
Added 2022-03-25
Due 2022-04-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
7
Netgear Wn604 FirmwareNetgear Wn802tv2 FirmwareNetgear Wnap320 Firmware+4 more
Timeline
PublishedApr 21
KEV addedMar 25
KEV dueApr 15
Latest updateMay 14
CISA Required Action: Apply updates per vendor instructions.

Description

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages7 packages

Patches

Patch: kb.netgear.com ↗Patch: kb.netgear.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-rfrg-rcwf-93m5: (1) boardData102↗2022-05-14
▶
CVEList
CVE-2016-1555: (1) boardData102↗2017-04-21
▶
VulnCheck
NETGEAR Multiple WAP Devices Command Injection Vulnerability↗2016
▶

💥Exploits & PoCs

3
Exploit-DB
Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit)↗2018-11-27
▶
Metasploit
Netgear Devices Unauthenticated Remote Command Execution↗
▶
Nuclei
NETGEAR WNAP320 Access Point Firmware - Remote Command Injection
▶

📋Vendor Advisories

1
CISA
NETGEAR Multiple WAP Devices Command Injection Vulnerability↗2022-03-25
▶
CVE-2016-1555 (CRITICAL CVSS 9.8) | (1) boardData102.php | cvebase.io