---
id: "CVE-2017-6862"
kind: "vulnerability"
aliases: ["CVE-2017-6862"]
title: "netgear wnr2000 firmware: NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42\u2026"
severity: "critical"
cvss: 9.8
epss: 0.45748
exploited: true
status: "resolved"
category: "infrastructure"
products: [{"name": "NETGEAR Multiple Devices", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "WNR2000v3", "fixed": ["1.1.2.14"], "affected": "< 1.1.2.14", "ecosystem": "vendor"}, {"name": "WNR2000v4", "fixed": ["1.0.0.66"], "affected": "< 1.0.0.66", "ecosystem": "vendor"}, {"name": "WNR2000v5", "fixed": ["1.0.0.42"], "affected": "< 1.0.0.42", "ecosystem": "vendor"}, {"name": "R2000", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "netgear wnr2000 firmware", "fixed": ["1.0.0.42"], "affected": "< 1.0.0.42", "ecosystem": "vendor"}, {"name": "netgear wnr2000 firmware", "fixed": ["1.0.0.66"], "affected": "< 1.0.0.66", "ecosystem": "vendor"}, {"name": "netgear wnr2000 firmware", "fixed": ["1.1.2.14"], "affected": "< 1.1.2.14", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "netgear", "network-gear", "r2000", "remote-management", "routers", "wnr2000"]
not_affected_if: ["other-netgear-models", "remote-management-disabled-and-no-untrusted-lan", "unknown"]
published_at: "2017-05-26T20:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6862", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-6862", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:13:23+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6862", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# netgear wnr2000 firmware: NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42…

Buffer overflow in the web admin interface of NETGEAR WNR2000v3, v4, v5 and R2000 routers. It gives unauthenticated authentication bypass and command execution. Exploitable from the LAN, or from the internet if remote management is on (off by default). CISA lists it as exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NETGEAR Multiple Devices affected ? fixed ?
- vendor:WNR2000v3 affected < 1.1.2.14 fixed 1.1.2.14
- vendor:WNR2000v4 affected < 1.0.0.66 fixed 1.0.0.66
- vendor:WNR2000v5 affected < 1.0.0.42 fixed 1.0.0.42
- vendor:R2000 affected unknown fixed ?
- vendor:netgear wnr2000 firmware affected < 1.0.0.42 fixed 1.0.0.42
- vendor:netgear wnr2000 firmware affected < 1.0.0.66 fixed 1.0.0.66
- vendor:netgear wnr2000 firmware affected < 1.1.2.14 fixed 1.1.2.14

## How to check

Log in to the router admin page and open Advanced > Administration > Firmware Update to read the firmware version. Compare it with the fixed versions. Also check Advanced > Remote Management: if it is enabled, the router is reachable from the internet.

## Fix

Update firmware to WNR2000v3 1.1.2.14 or later, WNR2000v4 1.0.0.66 or later, WNR2000v5 1.0.0.42 or later. R2000: take the latest firmware from NETGEAR support, since no specific version was read. Turn off remote management. Replace the router if it no longer gets updates.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-6862
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-6862
- 2026-10-23T21:13:23+00:00 analyst — NETGEAR PSV-2016-0261 and the CVE record list WNR2000v3/v4/v5 and R2000 as affected. Fixed versions come from the CVE record. KEV confirms exploitation; no public PoC link was checked.
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-6862

## Documents

- [advisory] NETGEAR PSV-2016-0261 https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261
- [describes] CVE Record CVE-2017-6862 https://www.cve.org/CVERecord?id=CVE-2017-6862

## From the sources

NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_