{"id":"CVE-2017-6862","kind":"vulnerability","aliases":["CVE-2017-6862"],"related":[],"title":"netgear wnr2000 firmware: NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42…","description":"NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.","summary":"Buffer overflow in the web admin interface of NETGEAR WNR2000v3, v4, v5 and R2000 routers. It gives unauthenticated authentication bypass and command execution. Exploitable from the LAN, or from the internet if remote management is on (off by default). CISA lists it as exploited in the wild.","severity":"critical","cvss":9.8,"epss":0.45748,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"NETGEAR Multiple Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"WNR2000v3","fixed":["1.1.2.14"],"affected":"< 1.1.2.14","ecosystem":"vendor"},{"name":"WNR2000v4","fixed":["1.0.0.66"],"affected":"< 1.0.0.66","ecosystem":"vendor"},{"name":"WNR2000v5","fixed":["1.0.0.42"],"affected":"< 1.0.0.42","ecosystem":"vendor"},{"name":"R2000","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"netgear wnr2000 firmware","fixed":["1.0.0.42"],"affected":"< 1.0.0.42","ecosystem":"vendor"},{"name":"netgear wnr2000 firmware","fixed":["1.0.0.66"],"affected":"< 1.0.0.66","ecosystem":"vendor"},{"name":"netgear wnr2000 firmware","fixed":["1.1.2.14"],"affected":"< 1.1.2.14","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","netgear","network-gear","r2000","remote-management","routers","wnr2000"],"not_affected_if":["other-netgear-models","remote-management-disabled-and-no-untrusted-lan","unknown"],"how_to_check":"Log in to the router admin page and open Advanced > Administration > Firmware Update to read the firmware version. Compare it with the fixed versions. Also check Advanced > Remote Management: if it is enabled, the router is reachable from the internet.","fix":"Update firmware to WNR2000v3 1.1.2.14 or later, WNR2000v4 1.0.0.66 or later, WNR2000v5 1.0.0.42 or later. R2000: take the latest firmware from NETGEAR support, since no specific version was read. Turn off remote management. Replace the router if it no longer gets updates.","status":"resolved","published_at":"2017-05-26T20:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:35+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T21:12:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware updates for your NETGEAR model; CISA says to apply updates per vendor instructions. Affected and fixed versions are unknown from the sources.","reach":"unknown","impact":"high","summary":"Multiple NETGEAR router and network devices contain a buffer overflow that lets an attacker bypass authentication. The same flaw allows remote code execution on the device.","category":"infrastructure","who_cares":["netgear","routers","network-gear"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker bypasses authentication and runs code on the device.","analyst_note":"Find the affected NETGEAR model list and fixed firmware versions from the CISA KEV entry and NETGEAR security advisories, and confirm the remote attack vector.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000457,"input_tokens":2836,"output_tokens":346,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected NETGEAR model list and fixed firmware versions from the CISA KEV entry and NETGEAR security advisories, and confirm the remote attack vector.","search":"'-0261':138C '-2016':137C '-2017':19A,22A '-6862':20A,23A '1.0.0.42':17A,112C '1.0.0.66':12A,107C '1.1.2.14':8A,103C 'admin':57B 'administr':130C 'allow':113C 'authent':70B,114C 'buffer':52B,122C 'bypass':71B,115C 'cisa':91B 'code':118C 'command':73B 'cve':18A,21A 'default':90B 'devic':6A,10A,15A,101C,105C,110C 'devices':26A 'execut':74B,119C 'exploit':40B,75B,95B 'firmwar':3A 'firmware':33A,36A,39A 'gear':45B 'give':68B 'id':134C 'infrastructur':41B 'interfac':58B 'internet':82B 'lan':78B 'list':92B 'manag':49B,85B 'multiple':25A 'netgear':1A,4A,24A,31A,34A,37A,42B,60B,99C,133C 'network':44B 'network-gear':43B 'overflow':53B,123C 'paramet':127C 'psv':136C 'r2000':30A,46B,65B 'remot':48B,84B,117C 'remote-manag':47B 'router':50B,66B 'unauthent':69B 'use':125C 'v4':62B 'v5':63B 'via':120C 'web':56B 'webapp':131C 'wild':98B 'wnr2000':2A,32A,35A,38A,51B 'wnr2000v3':5A,27A,61B,100C 'wnr2000v4':9A,28A,104C 'wnr2000v5':14A,29A,109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-05-26T20:29:00+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-6862","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6862","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:23+00:00","note":null},{"source":"epss","external_id":"CVE-2017-6862","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6862","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2017-6862:43","url":null,"severity":null,"published_at":"2026-10-23T21:13:23+00:00","modified_at":"2026-10-23T21:13:23+00:00","first_seen_at":"2026-10-23T21:13:23+00:00","fetched_at":"2026-10-23T21:13:23+00:00","note":"NETGEAR PSV-2016-0261 and the CVE record list WNR2000v3/v4/v5 and R2000 as affected. Fixed versions come from the CVE record. KEV confirms exploitation; no public PoC link was checked."},{"source":"nvd","external_id":"CVE-2017-6862","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6862","severity":null,"published_at":"2017-05-26T20:29:00+00:00","modified_at":"2026-06-17T01:23:13+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":915,"url":"https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261","title":"NETGEAR PSV-2016-0261","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":916,"url":"https://www.cve.org/CVERecord?id=CVE-2017-6862","title":"CVE Record CVE-2017-6862","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}