CVE-2016-1555

netgear wnap320 firmware, netgear wndap350 firmware, netgear wndap360 firmware

Published 21 Apr 2017 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

References

packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html · Third Party Advisory, VDB Entry
seclists.org/fulldisclosure/2016/Feb/112 · Mailing List, Third Party Advisory
kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic · Patch, Vendor Advisory
www.exploit-db.com/exploits/45909/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1555 · US Government Resource