The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html.

published 2017-01-30 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-1361

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-25
epss: 83.3%; EPSS 83.3% chance of exploitation in 30 days, percentile 99.6%
public exploits: 3; Metasploit, Exploit-DB

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

Patch / fix

cisa required action Apply updates per vendor instructions.

Timeline

2016-12-20 First public exploit (Metasploit exploit/linux/http/netgear_wnr2000_rce)
2017-01-30 Published
2022-03-25 Added to CISA KEV
2022-04-15 CISA patch deadline
2025-02-04 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-03-25)
Patch by: 2022-04-15 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: NETGEAR, WNR2000v5 Router
CISA name: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 21 mo ago (2025-02-04)

Exploit prediction

83.33% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/linux/http/netgear_wnr2000_rce NETGEAR WNR2000v5 (Un)authenticated hidden_lang_avi Stack Buffer Overflow metasploit exploit, excellent rank, 2016-12-20
EDB-41719 Netgear WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit) remote, 2017-03-24
EDB-40949 Netgear WNR2000v5 - Remote Code Execution remote, 2016-12-21
seclists.org http://seclists.org/fulldisclosure/2016/Dec/72 referenced PoC, tagged "exploit" by a source, unverified
raw.githubusercontent.com https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-120 Buffer Copy without Checking Size of Input

References

exploit-db.com /exploits/41719/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/40949/
exploit, third-party-advisory, vdb-entry
seclists.org /fulldisclosure/2016/Dec/72
exploit, mailing-list, third-party-advisory, vdb-entry
raw.githubusercontent.com /pedrib/PoC/master/advisories/netgear-wnr2000.txt
exploit, technical-description, third-party-advisory
kb.netgear.com /000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
vendor-advisory
securityfocus.com /bid/95867
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174
government-resource, us-government-resource

Sources

CVE List CVE-2016-10174
NVD CVE-2016-10174

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary