---
id: "CVE-2016-10174"
kind: "vulnerability"
aliases: ["CVE-2016-10174"]
title: "NETGEAR WNR2000v5 Router: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.83328
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "NETGEAR WNR2000v5 Router", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "WNR2000v5", "fixed": ["1.0.0.80 (latest; first fixed version not stated by NETGEAR)"], "affected": "<= 1.0.0.34 (1.0.0.34 confirmed vulnerable by Metasploit module); exact first fixed version unknown", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["end-of-life", "exploited", "home-router", "infrastructure", "netgear", "poc-public", "rce", "self-hosted", "wnr2000v5"]
not_affected_if: ["other-router-models", "remote-management-off-and-trusted-lan"]
published_at: "2017-01-30T04:59:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10174", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-10174", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:24:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10174", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# NETGEAR WNR2000v5 Router: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

Stack buffer overflow (hidden_lang_avi) in the NETGEAR WNR2000v5 web interface, chainable with the apply_noauth.cgi password-recovery flaws (CVE-2016-10175/10176) for unauthenticated RCE. Reachable from the LAN by default; reachable from the internet only if remote management is enabled (off by default). Public Metasploit module and exploit-db PoC; listed in CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NETGEAR WNR2000v5 Router affected ? fixed ?
- vendor:WNR2000v5 affected <= 1.0.0.34 (1.0.0.34 confirmed vulnerable by Metasploit module); exact first fixed version unknown fixed 1.0.0.80 (latest; first fixed version not stated by NETGEAR)

## How to check

Log in to the router admin page (routerlogin.net) and read the firmware version under Advanced > Administration. Version 1.0.0.34 or older is vulnerable. Then check Advanced > Remote Management: if 'Turn Remote Management On' is ticked, the router is reachable from the WAN.

## Fix

Install the latest WNR2000v5 firmware, 1.0.0.80 per NETGEAR's support page (via Advanced > Administration > Firmware Upgrade), and turn off remote management. NETGEAR's advisory does not name the first fixed version; 1.0.0.42 release notes say only 'fixed some security issues'. The model is End of Service, so replace it if it cannot be updated.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10174
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-10174
- 2026-10-23T21:24:52+00:00 analyst — NETGEAR PSV-2016-0255 (kb 000036549) lists WNR2000v5 and says all models are fixed but gives no version number. 1.0.0.34 is still vulnerable per the Metasploit module. Public PoC and Metasploit module exist. Reachable from the LAN by default, and from the WAN only if remote management is on. Model is End of Service; latest is 1.0.0.80.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-10174

## Documents

- [advisory] NETGEAR PSV-2016-0255 advisory https://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
- [describes] Ribeiro 0-day disclosure: RCE in NETGEAR WNR2000 https://lists.openwall.net/full-disclosure/2016/12/22/2
- [fix] WNR2000v5 support page: End of Service, latest 1.0.0.80 https://www.netgear.com/support/product/wnr2000v5
- [mentions] WNR2000v5 Firmware 1.0.0.42 release notes https://kb.netgear.com/000036680/WNR2000v5-Firmware-Version-1-0-0-42
- [poc] Metasploit netgear_wnr2000_rce (tested on 1.0.0.34) https://www.rapid7.com/db/modules/exploit/linux/http/netgear_wnr2000_rce/

## From the sources

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_