{"id":"CVE-2016-10174","kind":"vulnerability","aliases":["CVE-2016-10174"],"related":[],"title":"NETGEAR WNR2000v5 Router: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability","description":"The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.","summary":"Stack buffer overflow (hidden_lang_avi) in the NETGEAR WNR2000v5 web interface, chainable with the apply_noauth.cgi password-recovery flaws (CVE-2016-10175/10176) for unauthenticated RCE. Reachable from the LAN by default; reachable from the internet only if remote management is enabled (off by default). Public Metasploit module and exploit-db PoC; listed in CISA KEV.","severity":"critical","cvss":10.0,"epss":0.83328,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"NETGEAR WNR2000v5 Router","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"WNR2000v5","fixed":["1.0.0.80 (latest; first fixed version not stated by NETGEAR)"],"affected":"<= 1.0.0.34 (1.0.0.34 confirmed vulnerable by Metasploit module); exact first fixed version unknown","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["end-of-life","exploited","home-router","infrastructure","netgear","poc-public","rce","self-hosted","wnr2000v5"],"not_affected_if":["other-router-models","remote-management-off-and-trusted-lan"],"how_to_check":"Log in to the router admin page (routerlogin.net) and read the firmware version under Advanced > Administration. Version 1.0.0.34 or older is vulnerable. Then check Advanced > Remote Management: if 'Turn Remote Management On' is ticked, the router is reachable from the WAN.","fix":"Install the latest WNR2000v5 firmware, 1.0.0.80 per NETGEAR's support page (via Advanced > Administration > Firmware Upgrade), and turn off remote management. NETGEAR's advisory does not name the first fixed version; 1.0.0.42 release notes say only 'fixed some security issues'. The model is End of Service, so replace it if it cannot be updated.","status":"open","published_at":"2017-01-30T04:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:53+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:21:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions, as CISA requires; the fixed firmware version is unknown from the sources.\nReplace the device if no fixed firmware is available, since the model is end-of-life per the sources: unknown.","reach":"unknown","impact":"high","summary":"The NETGEAR WNR2000v5 home router has a buffer overflow in its firmware. An attacker can run code on the router, which is the network gateway for the connected devices.","category":"infrastructure","who_cares":["netgear","wnr2000v5","home-router","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the router and controls traffic for the network","analyst_note":"Find the vendor advisory and fixed firmware version for WNR2000v5, and confirm whether the flaw is reachable from the WAN or only the LAN.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-router-models"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000471,"input_tokens":2843,"output_tokens":374,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory and fixed firmware version for WNR2000v5, and confirm whether the flaw is reachable from the WAN or only the LAN.","search":"'-10174':12A,15A '-10175':60B '-2016':11A,14A,59B '/10176':61B '/apply.cgi':114C '/lang_check.html':115C 'achiev':127C 'apply_noauth.cgi':53B 'attack':125C 'avi':43B,108C 'buffer':7A,39B,102C,117C 'chainabl':50B 'cisa':94B 'code':129C 'contain':100C 'cve':10A,13A,58B 'db':90B 'default':70B,83B 'enabl':80B 'end':21B 'end-of-lif':20B 'execut':130C 'exploit':24B,89B,121C 'exploit-db':88B 'flaw':57B 'hidden':41B,106C 'home':26B 'home-rout':25B 'host':36B 'infrastructur':28B 'interfac':49B 'internet':74B 'invok':111C 'kev':95B 'lan':68B 'lang':42B,107C 'life':23B 'list':92B 'manag':78B 'metasploit':85B 'modul':86B 'netgear':1A,4A,16A,29B,46B,97C 'overflow':8A,40B,103C,118C 'paramet':109C 'password':55B 'password-recoveri':54B 'poc':31B,91B 'poc-publ':30B 'public':32B,84B 'rce':33B,64B 'reachabl':65B,71B 'recoveri':56B 'remot':77B,128C 'router':3A,6A,18A,27B,99C 'self':35B 'self-host':34B 'stack':38B 'unauthent':63B,124C 'url':113C 'vulner':9A 'web':48B 'wnr2000v5':2A,5A,17A,19A,37B,47B,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-01-30T04:59:00+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2016-10174","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10174","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2016-10174","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-10174","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2016-10174:72","url":null,"severity":null,"published_at":"2026-10-23T21:24:52+00:00","modified_at":"2026-10-23T21:24:52+00:00","first_seen_at":"2026-10-23T21:24:52+00:00","fetched_at":"2026-10-23T21:24:52+00:00","note":"NETGEAR PSV-2016-0255 (kb 000036549) lists WNR2000v5 and says all models are fixed but gives no version number. 1.0.0.34 is still vulnerable per the Metasploit module. Public PoC and Metasploit module exist. Reachable from the LAN by default, and from the WAN only if remote management is on. Model is End of Service; latest is 1.0.0.80."},{"source":"nvd","external_id":"CVE-2016-10174","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10174","severity":null,"published_at":"2017-01-30T04:59:00+00:00","modified_at":"2026-06-17T00:39:12+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":997,"url":"https://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability","title":"NETGEAR PSV-2016-0255 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1000,"url":"https://lists.openwall.net/full-disclosure/2016/12/22/2","title":"Ribeiro 0-day disclosure: RCE in NETGEAR WNR2000","kind":"post","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1001,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/netgear_wnr2000_rce/","title":"Metasploit netgear_wnr2000_rce (tested on 1.0.0.34)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1002,"url":"https://www.netgear.com/support/product/wnr2000v5","title":"WNR2000v5 support page: End of Service, latest 1.0.0.80","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1003,"url":"https://kb.netgear.com/000036680/WNR2000v5-Firmware-Version-1-0-0-42","title":"WNR2000v5 Firmware 1.0.0.42 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}