# CVE-2017-6334

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

- Page: https://www.vulneraibility.com/cve/CVE-2017-6334
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15
- EPSS: 72.64% (percentile 99.5)
- Public exploit code: 3 on Exploit-DB · 1 Metasploit module (first 2017-02-25)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-04)
- Weakness: CWE-78
- Published: 2017-03-06

## Affected

- netgear:dgn2200_series_firmware

## References

- [other] http://www.securityfocus.com/bid/96463
- [exploit] https://www.exploit-db.com/exploits/41459/
- [exploit] https://www.exploit-db.com/exploits/41472/
- [exploit] https://www.exploit-db.com/exploits/42257/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6334

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.