ACTIVELY EXPLOITED
CVE-2017-6334: NETGEAR DGN2200 Devices OS Command Injection Vulnerability
| Vendor | NETGEAR |
|---|---|
| Product | DGN2200 Devices |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Mar 2022 |
| CISA federal deadline | 15 Apr 2022 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
The impacted product is end-of-life and should be disconnected if still in use.
Description (NVD)
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
SOURCES
Other NETGEAR flaws
- CVE-2017-5521: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
- CVE-2017-6862: NETGEAR Multiple Devices Buffer Overflow Vulnerability
- CVE-2016-1555: NETGEAR Multiple WAP Devices Command Injection Vulnerability
- CVE-2016-10174: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
- CVE-2017-6077: NETGEAR DGN2200 Remote Code Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.