CVE-2016-10176: netgear wnr2000v5_firmware Improper Input Validation
Vulnerability summary
CVE-2016-10176 is a critical (CVSS 9.8) Improper Input Validation vulnerability in netgear wnr2000v5_firmware. EPSS estimates a 77.43% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 4 public exploits are recorded.
Timeline
- 30-01-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
77.43%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
-0.15 pp
From 77.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (raw.githubusercontent.com)
Maturity: unknown
Netgear WNR2000v5 - Remote Code Execution
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Netgear1 product
- wnr2000v5_firmware≤ 1.0.0.34
1 vendor · 1 product
References
5 links- raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txtX Refsource MISCExploitTechnical DescriptionThird Party Advisory
- kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-VulnerabilityX Refsource MISCPatchVendor Advisory