CVE-2017-6334
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- NETGEAR DGN2200 Devices OS Command Injection Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
Description
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 73% (percentile: 99) as of 1 November 2026
- CWE
- CWE-78
Affected products
netgear: dgn2200 series firmware; netgear: dgn2200v1; netgear: dgn2200v2; netgear: dgn2200v3; netgear: dgn2200v4
References
- https://www.exploit-db.com/exploits/41459/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41472/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42257/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41459/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41472/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42257/ ExploitThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/96463 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/96463 Broken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017… US Government Resource