CVE-2016-11022 Command injection in n/a
Remote attackers can execute arbitrary code with root privileges on NETGEAR Prosafe wireless controllers via shell metacharacters in the login handler.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-11022?
CVE-2016-11022 is a high-severity command injection vulnerability in n/a, published on 23 Mar 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharacters in the reqMethod parameter to login_handler.php.
Weakness: CWE-78
Which versions are affected by CVE-2016-11022?
It affects 3 products.
Products include Netgear Prosafe Wc7520 Firmware, Netgear Prosafe Wc7600 Firmware, Netgear Prosafe Wc9500 Firmware.
How do I fix CVE-2016-11022?
No fix has been published for CVE-2016-11022 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-11022 being exploited?
There is no known exploitation of CVE-2016-11022 in the wild and no public exploit code.
Sources
Also known as GHSA-hgc7-5rw6-5h4m.