{"id":"CVE-2017-6334","kind":"vulnerability","aliases":["CVE-2017-6334"],"related":[],"title":"NETGEAR DGN2200 Devices: NETGEAR DGN2200 Devices OS Command Injection Vulnerability","description":"dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.","summary":"NETGEAR DGN2200 home routers have an OS command injection flaw in the dnslookup.cgi web page. An attacker who can log in to the router's admin interface can run arbitrary commands on the device.","severity":"critical","cvss":9.0,"epss":0.7264,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"NETGEAR DGN2200 Devices","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dgn2200","exploited","home-router","infrastructure","netgear","self-hosted"],"not_affected_if":["firmware-newer-than-10.0.0.50","not-dgn2200"],"how_to_check":"Identify any NETGEAR DGN2200 devices on the network and note their firmware version; the source says firmware through 10.0.0.50 is affected.","fix":"The product is end-of-life; CISA says to disconnect it if still in use. Replace the device with a supported router.","status":"open","published_at":"2017-03-06T02:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:08+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:20:08Z","model":"claude-haiku-5-5","output":{"fix":"The product is end-of-life; CISA says to disconnect it if still in use. Replace the device with a supported router.\nunknown","reach":"network","impact":"high","summary":"NETGEAR DGN2200 home routers have an OS command injection flaw in the dnslookup.cgi web page. An attacker who can log in to the router's admin interface can run arbitrary commands on the device.","category":"infrastructure","who_cares":["netgear","dgn2200","self-hosted","home-router"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands on the router as an authenticated user","analyst_note":"Confirm whether any fixed firmware exists and whether the router's admin interface is reachable from the internet; check the NETGEAR security advisory for the affected version range.","how_to_check":"Identify any NETGEAR DGN2200 devices on the network and note their firmware version; the source says firmware through 10.0.0.50 is affected.\nunknown","needs_analyst":true,"not_affected_if":["not-dgn2200","firmware-newer-than-10.0.0.50"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000499,"input_tokens":2867,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2017':12A,15A,100C '-6077':101C '-6334':13A,16A '10.0.0.50':72C 'admin':55B 'allow':73C 'arbitrari':59B,79C 'attack':46B 'authent':75C 'command':8A,37B,60B,81C 'cve':11A,14A,99C 'devic':3A,6A,63B,68C 'devices':19A 'dgn2200':2A,5A,18A,20B,31B,67C 'differ':96C 'dnslookup.cgi':42B,64C 'execut':78C 'exploit':21B 'field':89C 'firmwar':70C 'flaw':39B 'home':23B,32B 'home-rout':22B 'host':29B,87C 'http':92C 'infrastructur':25B 'inject':9A,38B 'interfac':56B 'log':49B 'metacharact':84C 'name':88C 'netgear':1A,4A,17A,26B,30B,66C 'os':7A,36B,80C 'page':44B 'post':93C 'remot':74C 'request':94C 'router':24B,33B,53B 'run':58B 'self':28B 'self-host':27B 'shell':83C 'user':76C 'via':82C 'vulner':10A,97C 'web':43B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-06T02:59:00+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-6334","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6334","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:24+00:00","note":null},{"source":"epss","external_id":"CVE-2017-6334","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6334","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-6334","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6334","severity":null,"published_at":"2017-03-06T02:59:00+00:00","modified_at":"2026-06-17T01:22:10+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}