8.8high
CVE-2017-63661 exploit
Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attacker…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
1
Exploit-DB
Summary
Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi. NOTE: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.
Exploit prediction (EPSS)
3.47% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.
Exploits and detections
- EDB-41472 Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery · webapps · 2017-02-28
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- exploit-db.com /exploits/41472/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2017-6366
- NVD: CVE-2017-6366
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.