CVE-2017-6334
Published 2017-03-06 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2017-6334 is a high-severity (CVSS 8.8) vulnerability in NETGEAR DGN2200 Devices. CISA added it to the Known Exploited Vulnerabilities catalog on March 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 15, 2022. CISA does not currently list it as used in ransomware campaigns. NETGEAR has 8 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 8 known-exploited NETGEAR vulnerabilities →Description
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: NETGEAR — DGN2200 Devices
Name: NETGEAR DGN2200 Devices OS Command Injection Vulnerability
Date added: 2022-03-25 · Due: 2022-04-15
Required action: The impacted product is end-of-life and should be disconnected if still in use.
References
- http://www.securityfocus.com/bid/96463
- https://www.exploit-db.com/exploits/41459/
- https://www.exploit-db.com/exploits/41472/
- https://www.exploit-db.com/exploits/42257/
- http://www.securityfocus.com/bid/96463
- https://www.exploit-db.com/exploits/41459/
- https://www.exploit-db.com/exploits/41472/
- https://www.exploit-db.com/exploits/42257/