VulnCheck KEV: CVE-2016-10176

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server uhttpd and processed accordingly. The web server also contains another URL, applynoauth.cgi, that...

PT-2017-4192

Name of the Vulnerable Software and Affected Versions NETGEAR WNR2000v3 versions prior to 1.1.2.14 NETGEAR WNR2000v4 versions prior to 1.0.0.66 NETGEAR WNR2000v5 versions prior to 1.0.0.42 Description The issue allows authentication bypass and remote code execution via a buffer overflow in the...

CVE-2017-6862: Buffer Copy without Checking Size of Input

NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261...

NETGEAR WNR2000v5 - (Un)authenticated hidden_lang_avi Stack Overflow Exploit

Exploit for hardware platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'time' class MetasploitModule 'NETGEAR WNR2000v5 Unauthenticated hiddenlangavi Stack...

NETGEAR WNR2000v5 (Un)authenticated hidden_lang_avi Stack Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'time' class MetasploitModule 'NETGEAR WNR2000v5 Unauthenticated hiddenlangavi Stack Overflow', 'Description' = %q The NETGEAR WNR2000 router h...

Netgear WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'time' class MetasploitModule 'NETGEAR WNR2000v5 Unauthenticated hiddenlangavi Stack Overflow', 'Description' = %q The NETGEAR WNR2000 router h...

NETGEAR WNR2000v5 router information disclosure vulnerability

The NETGEAR WNR2000v5 router is a popular router device. A security vulnerability in the NETGEAR WNR2000v5 router allows remote attackers to exploit the vulnerability by submitting a special /BRSnetgearsuccess.html URI request, which can be used to obtain administrator username and password...

NETGEAR WNR2000v5 router authentication bypass vulnerability

The NETGEAR WNR2000v5 router is a popular router device. An authentication bypass vulnerability exists in the NETGEAR WNR2000v5 router. An attacker can use this vulnerability to bypass the authentication mechanism and perform unauthorized operations...

NETGEAR WNR2000v5 router hidden_lang_avi buffer overflow vulnerability

The NETGEAR WNR2000v5 router is a popular router device. A buffer overflow vulnerability exists in the NETGEAR WNR2000v5 router's handling of hiddenlangavi, which allows remote attackers to exploit the vulnerability to submit a special request, execute arbitrary code, or crash the application...

CVE-2016-10176

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server uhttpd and processed accordingly. The web server also contains another URL, applynoauth.cgi, that...

CVE-2016-10175

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRSnetgearsuccess.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers t...

Remote code execution

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server uhttpd and processed accordingly. The web server also contains another URL, applynoauth.cgi, that...

CVE-2016-10174

The NETGEAR WNR2000v5 router contains a buffer overflow in the hiddenlangavi parameter when invoking the URL /apply.cgi?/langcheck.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution...

CVE-2016-10176: Improper Input Validation

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server uhttpd and processed accordingly. The web server also contains another URL, applynoauth.cgi, that...

CVE-2016-10175: Exposure of Sensitive Information to an Unauthorized Actor

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRSnetgearsuccess.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers t...

CVE-2016-10174: Buffer Copy without Checking Size of Input

The NETGEAR WNR2000v5 router contains a buffer overflow in the hiddenlangavi parameter when invoking the URL /apply.cgi?/langcheck.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution...

PT-2017-7785

Name of the Vulnerable Software and Affected Versions NETGEAR WNR2000v5 router Description The issue allows an unauthenticated user to perform sensitive actions on the device by invoking a specific URL on the web server. This can be exploited to change router settings, such as password-recovery...

PT-2017-3172 · NetGear · Netgear Wnr2000V5 Router

Name of the Vulnerable Software and Affected Versions: NETGEAR WNR2000v5 Router affected versions not specified Description: The issue is caused by a buffer overflow in the hidden lang avi parameter when invoking the URL "/apply.cgi?/lang check.html". This can be exploited by an unauthenticated...

NETGEAR WNR2000v5 - Remote Code Execution

NETGEAR WNR2000v5 - Remote Code Execution Remote code execution in NETGEAR WNR2000v5 - by Pedro Ribeiro [email protected] / Agile Information Security Released on 20/12/2016 NOTE: this exploit is "alpha" quality and has been deprecated. Please see the modules accepted into the Metasploit framework...

PT-2017-7784

Name of the Vulnerable Software and Affected Versions NETGEAR WNR2000v5 router Description The issue allows the leakage of the router's serial number when a request is made to the "/BRS netgear success.html" API endpoint. This serial number can be used in combination with another vulnerability to...