ACTIVELY EXPLOITED
CVE-2017-5521: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
| Vendor | NETGEAR |
|---|---|
| Product | Multiple Devices |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Sep 2022 |
| CISA federal deadline | 29 Sep 2022 |
| Weakness (CWE) | CWE-200 |
Required action (CISA's text)
Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
Description (NVD)
Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
SOURCES
Other NETGEAR flaws
- CVE-2017-6862: NETGEAR Multiple Devices Buffer Overflow Vulnerability
- CVE-2017-6334: NETGEAR DGN2200 Devices OS Command Injection Vulnerability
- CVE-2016-1555: NETGEAR Multiple WAP Devices Command Injection Vulnerability
- CVE-2016-10174: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
- CVE-2017-6077: NETGEAR DGN2200 Remote Code Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.