CVE-2017-6862
NETGEAR Multiple Devices Buffer Overflow Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 22 June 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 45.75% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 8 June 2022 · due 22 June 2022
- Weakness
- CWE-120
- Affected
- netgear/wnr2000 firmware
- Source
- a2826606-91e7-4eb6-899e-8484bd4575d5
EPSS moved from 45.7% on 24 September 2026 to 45.7% on 27 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-6862
References
- http://www.securityfocus.com/bid/98740Broken Link, Third Party Advisory, VDB Entry
- https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261Vendor Advisory
- https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_netgear_wnr2000v5_-_cve-2017-6862.pdfBroken Link
- http://www.securityfocus.com/bid/98740Broken Link, Third Party Advisory, VDB Entry
- https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261Vendor Advisory
- https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_netgear_wnr2000v5_-_cve-2017-6862.pdfBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6862US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.