CVE-2017-6334

netgear dgn2200 series firmware

Published 6 Mar 2017 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

Description

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

References

www.securityfocus.com/bid/96463 · Broken Link, Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/41459/ · Exploit, Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/41472/ · Exploit, Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/42257/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6334 · US Government Resource