CVE-2017-6334 NETGEAR DGN2200 Devices OS Command Injection
Authenticated attackers can execute arbitrary OS commands on NETGEAR DGN2200 routers via the dnslookup.cgi interface.
- Exploited in the wild
- Since 25 Mar 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6334?
CVE-2017-6334 is a high-severity command injection vulnerability in n/a, published on 6 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
Weakness: CWE-78
Which versions are affected by CVE-2017-6334?
It affects 1 product.
Products include Netgear Dgn2200 Series Firmware.
How do I fix CVE-2017-6334?
No fix has been published for CVE-2017-6334 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-6334 being exploited?
Yes. Attackers have exploited CVE-2017-6334 in the wild since at least 25 Mar 2022.
Public exploit code: 1 Metasploit module and 3 Exploit-DB entries.
Sources
Also known as GHSA-fmcr-2q62-c3m5.