CVE-2017-6334
NETGEAR DGN2200 Devices OS Command Injection Vulnerability
Description
CVE-2017-6334 is a high-severity command injection vulnerability affecting NETGEAR DGN2200 Devices. dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands An attacker can exploit this flaw with low privileges over the network. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 89.21% (99.5th percentile) indicates a significantly elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netgear | dgn2200 series firmware | <= 10.0.0.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/96463(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41459/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41472/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42257/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6334(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS Command Injection is a vulnerability that occurs when software constructs all or part of an operating system command using externally-influenced input from an upstream component, but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command. Unlike general command injection (CWE-77), OS command injection specifically targets system shells like bash, cmd. In the case of CVE-2017-6334, this weakness allows attackers to compromise NETGEAR DGN2200 Devices systems.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2017-6334 carries a CVSS 3.1 base score of 8.8 (HIGH), reflecting the serious risk it poses to affected environments. Successful exploitation can lead to complete compromise of data confidentiality, full system integrity compromise, and complete denial of service. The attack vector is network-based with low complexity, meaning exploitation is straightforward and can be reliably repeated. Organizations running NETGEAR DGN2200 Devices face tangible risk of unauthorized access, data breaches, and operational disruption if this vulnerability remains unpatched.
Exploit Maturity
CVE-2017-6334 is listed in the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-04-15, confirming that real-world exploitation has been observed. The EPSS score of 89.21% (99.5th percentile) places this vulnerability among those most likely to be exploited. Public exploit code is available in vulnerability databases, lowering the barrier for attackers and increasing the urgency of remediation.
Remediation
- The impacted product is end-of-life and should be disconnected if still in use. This is the CISA-mandated remediation action and should be prioritized immediately.
- If the device cannot be immediately decommissioned, isolate it from the network by placing it behind strict firewall rules that block all inbound access from untrusted networks.
- Plan and execute migration to a supported replacement product that receives active security updates.
- Audit network logs and device configurations for indicators of compromise, including unexpected outbound connections, unauthorized configuration changes, or newly created accounts.
- Implement network monitoring to detect any exploitation attempts against the affected DGN2200 Devices systems.
Technical Details
CVE-2017-6334 is exploitable remotely over the network with low-level user credentials. dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands The attack complexity is rated low, meaning no specialized conditions or preparation are needed beyond network access to the target. The scope is unchanged, meaning the impact is confined to the vulnerable component. The CVSS 3.1 base score of 8.8 reflects the combination of these factors and the potential for significant damage to affected systems.
Frequently Asked Questions
Is CVE-2017-6334 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2017-6334 to the Known Exploited Vulnerabilities catalog. The EPSS score of 89.21% (99.5th percentile) further indicates high exploitation likelihood.
What products are affected by CVE-2017-6334?
CVE-2017-6334 affects NETGEAR DGN2200 Devices.
How do I fix CVE-2017-6334?
The impacted product is end-of-life and should be disconnected if still in use. Migrate to a supported product as soon as possible.
How severe is CVE-2017-6334?
CVE-2017-6334 has a CVSS 3.1 score of 8.8 (HIGH). This is a high-severity vulnerability that poses significant risk and requires prompt remediation. The vulnerability enables authenticated remote attackers to potentially compromise affected DGN2200 Devices systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.