vulnwire
9.8crit

CVE-2016-1555KEVin critical feed2 exploitsNuclei template

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2022-03-25
EPSS
98.3%
percentile 100%
Public exploits
2
Metasploit · Exploit-DB · Nuclei check

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-04-15 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
NETGEAR / Wireless Access Point (WAP) Devices
CISA name
NETGEAR Multiple WAP Devices Command Injection Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

98.32% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Nuclei template NETGEAR WNAP320 Access Point Firmware - Remote Command Injection · nuclei detection template
  • Metasploit exploit/linux/http/netgear_unauth_exec Netgear Devices Unauthenticated Remote Command Execution · metasploit exploit, excellent rank · 2016-02-25
  • EDB-45909 Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit) · remote · 2018-11-27

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

  • kb.netgear.com /30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic · x_refsource_CONFIRM, x_transferred
  • packetstormsecurity.com /files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/45909/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • seclists.org /fulldisclosure/2016/Feb/112 · mailing-list, x_refsource_FULLDISC, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1555 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.