{"id":"CVE-2017-6077","kind":"vulnerability","aliases":["CVE-2017-6077"],"related":[],"title":"NETGEAR Wireless Router DGN2200: NETGEAR DGN2200 Remote Code Execution Vulnerability","description":"ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.","summary":"NETGEAR DGN2200 wireless routers contain a flaw that allows remote code execution on the device. An attacker who can reach the router can run commands on it, which typically gives control of the home or office network it serves.","severity":"critical","cvss":10.0,"epss":0.68712,"exploited":true,"exploited_at":"2022-03-07T00:00:00+00:00","products":[{"name":"NETGEAR Wireless Router DGN2200","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dgn2200","exploited","home-router","infrastructure","netgear","self-hosted"],"not_affected_if":["other-router-model"],"how_to_check":"Check the router model and firmware version on the admin page or with the label on the device; unknown whether the sources list affected firmware builds.","fix":"Apply the firmware update from NETGEAR per vendor instructions (CISA required action); unknown which exact build is fixed.\nReplace the device if no fixed firmware is available.","status":"open","published_at":"2017-02-22T23:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:23:56+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:23:56Z","model":"claude-haiku-5-5","output":{"fix":"Apply the firmware update from NETGEAR per vendor instructions (CISA required action); unknown which exact build is fixed.\nReplace the device if no fixed firmware is available.","reach":"internet","impact":"high","summary":"NETGEAR DGN2200 wireless routers contain a flaw that allows remote code execution on the device. An attacker who can reach the router can run commands on it, which typically gives control of the home or office network it serves.","category":"infrastructure","who_cares":["netgear","dgn2200","self-hosted","home-router"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the router and controls traffic on the network","analyst_note":"Find the affected and fixed firmware versions and the exact trigger from NETGEAR's advisory or the KEV entry; the sources give only a one-line description.","how_to_check":"Check the router model and firmware version on the admin page or with the label on the device; unknown whether the sources list affected firmware builds.\nunknown","needs_analyst":true,"not_affected_if":["other-router-model"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000489,"input_tokens":2836,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2017':12A,15A '-6077':13A,16A '10.0.0.50':78C 'allow':39B,79C 'arbitrari':85C 'attack':47B 'authent':81C 'code':8A,41B 'command':55B,87C 'contain':35B 'control':61B 'cve':11A,14A 'devic':45B,74C 'dgn2200':4A,6A,20A,21B,32B,73C 'execut':9A,42B,84C 'exploit':22B 'field':95C 'firmwar':76C 'flaw':37B 'give':60B 'home':24B,64B 'home-rout':23B 'host':30B 'http':98C 'infrastructur':26B 'ipaddr':94C 'metacharact':90C 'netgear':1A,5A,17A,27B,31B,72C 'network':67B 'offic':66B 'os':86C 'ping':93C 'ping.cgi':70C 'post':99C 'reach':50B 'remot':7A,40B,80C 'request':100C 'router':3A,19A,25B,34B,52B 'run':54B 'self':29B 'self-host':28B 'serv':69B 'shell':89C 'typic':59B 'user':82C 'via':88C 'vulner':10A 'wireless':2A,18A,33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-02-22T23:59:00+00:00","kev":{"dateAdded":"2022-03-07","dueDate":"2022-09-07","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-6077","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6077","severity":null,"published_at":"2022-03-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2017-6077","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6077","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-6077","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6077","severity":null,"published_at":"2017-02-22T23:59:00+00:00","modified_at":"2026-06-17T01:21:45+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}