CVE-2017-6334: NETGEAR DGN2200 Devices OS Command Injection Vulnerability
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the hostname field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Disconnect NETGEAR DGN2200 devices from the network if they are still in use, since the impacted product is end-of-life.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6334?
CVE-2017-6334 is rated as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2017-6334?
To fix CVE-2017-6334, you should update the firmware of your NETGEAR DGN2200 devices to a version above 10.0.0.50.
Who is affected by CVE-2017-6334?
CVE-2017-6334 affects NETGEAR DGN2200 devices running firmware versions up to 10.0.0.50.
What type of vulnerability is CVE-2017-6334?
CVE-2017-6334 is a remote command execution vulnerability that allows attackers to execute arbitrary OS commands.
Can CVE-2017-6334 be exploited remotely?
Yes, CVE-2017-6334 can be exploited remotely by authenticated users through specially crafted HTTP POST requests.