CVE-2016-1555 kev in the critical feed json
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3…
published 2017-04-21 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2650
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-03-25
- epss
- 98.3%
- EPSS 98.3% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
Patch / fix
cisa required action Apply updates per vendor instructions.
Timeline
- First public exploit (Metasploit exploit/linux/http/netgear_unauth_exec)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-04-15 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- NETGEAR, Wireless Access Point (WAP) Devices
- CISA name
- NETGEAR Multiple WAP Devices Command Injection Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
98.32% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/linux/http/netgear_unauth_exec Netgear Devices Unauthenticated Remote Command Execution metasploit exploit, excellent rank, 2016-02-25
- EDB-45909 Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit) remote, 2018-11-27
- Nuclei template NETGEAR WNAP320 Access Point Firmware - Remote Command Injection nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
kb.netgear.com
/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic
patch, vendor-advisory
-
exploit-db.com
/exploits/45909/
exploit, third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html
third-party-advisory, vdb-entry
-
seclists.org
/fulldisclosure/2016/Feb/112
mailing-list, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1555
government-resource, us-government-resource
Sources
- CVE List CVE-2016-1555
- NVD CVE-2016-1555
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.