# CVE-2016-10174

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2016-10174
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15
- EPSS: 83.33% (percentile 99.7)
- Public exploit code: 2 on Exploit-DB · 1 Metasploit module (first 2016-12-21)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-04)
- Weakness: CWE-120
- Published: 2017-01-30

## Affected

- netgear:d6100_firmware
- netgear:d7000_firmware
- netgear:d7800_firmware
- netgear:jnr1010v2_firmware
- netgear:jnr3300_firmware
- netgear:jwnr2010v5_firmware
- netgear:r2000_firmware
- netgear:r6100_firmware
- netgear:r6220_firmware
- netgear:r7500_firmware
- netgear:r7500v2_firmware
- netgear:wndr3700v4_firmware
- netgear:wndr3800_firmware
- netgear:wndr4300_firmware
- netgear:wndr4300v2_firmware
- netgear:wndr4500v3_firmware
- netgear:wndr4700_firmware
- netgear:wnr1000v2_firmware
- netgear:wnr1000v4_firmware
- netgear:wnr2000v3_firmware
- netgear:wnr2000v4_firmware
- netgear:wnr2000v5_firmware
- netgear:wnr2020_firmware
- netgear:wnr2050_firmware
- netgear:wnr2200_firmware
- netgear:wnr2500_firmware
- netgear:wnr614_firmware
- netgear:wnr618_firmware

## References

- [other] http://seclists.org/fulldisclosure/2016/Dec/72
- [other] https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
- [other] http://www.securityfocus.com/bid/95867
- [exploit] https://www.exploit-db.com/exploits/41719/
- [other] http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
- [exploit] https://www.exploit-db.com/exploits/40949/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.