VulnCheck KEV: CVE-2017-6334

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands...

VulnCheck KEV: CVE-2017-6077

NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution...

Netgear DGN2200 DGND3700 - Admin Password Disclosure

Netgear DGN2200 DGND3700 - Admin Password Disclosure /bin/bash PoC based on CVE-2016-5649 created by Social Engineering Neo. Long Method: https://www.youtube.com/watch?v=f3awG0XPKAs https://www.shodan.io/search?query=DGN2200 = 2,325 possible vulnerable devices...

Netgear DGN2200 Information Disclosure Vulnerability

NETGEAR DGN2200 is a wireless router product from NETGEAR. An information disclosure vulnerability exists in the BSWcxttongr.htm page in the Netgear DGN2200 DGN2200-V1.0.0.507.0.50 version and DGND3700 DGND3700-V1.0.0.171.0.17 version. A remote attacker can exploit this vulnerability to gain...

CVE-2016-5649

A vulnerability is in the 'BSWcxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.507.0.50, and DGND3700, version DGND3700-V1.0.0.171.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text...

Authentication flaw

A vulnerability is in the 'BSWcxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.507.0.50, and DGND3700, version DGND3700-V1.0.0.171.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text...

CVE-2016-5649 Netgear DGN2200 and DGND3700 disclose the administrator password

A vulnerability is in the 'BSWcxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.507.0.50, and DGND3700, version DGND3700-V1.0.0.171.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text...

CVE-2016-5649

Vulnerability summary (CVE-2016-5649) : Netgear DGN2200 (V1.0.0.50_7.0.50) and DGND3700 (V1.0.0.17_1.0.17) expose an unauthenticated admin password via the web page BSW_cxttongr.htm. When accessed, the page processes the request and returns the administrator password in clear text before redirect...

NETGEAR DGN2200 Remote Code Execution (CVE-2017-5521; CVE-2017-6077)

A remote code execution vulnerability has been reported in NETGEAR DGN2200 routers. Successful exploitation could lead to arbitrary code execution...

Information Disclosure Vulnerability in US Netgear DGND3700/DGN2200

The DGND3700/DGN2200 are wireless router products from Netgear USA. An information disclosure vulnerability exists in the American Netgear DGND3700/DGN2200. The vulnerability is due to a privileged page and can be exploited by an attacker to obtain sensitive information in the respnose comment...

Netgear DGN2200 dnslookup.cgi Command Injection (CVE-2017-6334)

A command injection vulnerability exists in NETGEAR DGN2200 Router. The vulnerability is due to insufficient input validation in the router's web administration. Successful exploitation of this vulnerability could allow a remote attacker with valid login details to execute arbitrary code...

NETGEAR DGN2200 CVE-2017-6334 RCE Vulnerability

NETGEAR DGN2200 is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NETGEAR DGN2200 Router Detection (HTTP)

HTTP based detection of NETGEAR DGN 2200 routers. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Netgear DGN2200 - 'dnslookup.cgi' Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/http' require "base64" class MetasploitModule "Netgear DGN2200 dnslookup.cgi Command Injection", 'Description' = %q This module exploits a command injection...

Netgear DGN2200 dnslookup.cgi Command Injection Vulnerability

The NETGEAR DGN2200 is an ADSL router device. A command injection vulnerability exists in Netgear DGN2200 dnslookup.cgi. This module allows attackers to exploit the vulnerability to inject arbitrary commands by sending a specially crafted publish request with valid login details...

Netgear DGN2200 dnslookup.cgi Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/http' require "base64" class MetasploitModule "Netgear DGN2200 dnslookup.cgi Command Injection", 'Description' = %q This module exploits a command injection...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the hostname parameter to dnslookup.cgi. NOTE: this issue can be combined with...

CVE-2017-6366

Cross-site request forgery CSRF vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the hostname parameter to dnslookup.cgi. NOTE: this issue can be combined with...

CVE-2017-6366

Cross-site request forgery CSRF vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the hostname parameter to dnslookup.cgi. NOTE: this issue can be combined with...

CVE-2017-6366

Cross-site request forgery CSRF vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the hostname parameter to dnslookup.cgi. NOTE: this issue can be combined with...