dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands…

published 2017-03-06 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15395

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-25
epss: 72.6%; EPSS 72.6% chance of exploitation in 30 days, percentile 99.4%
public exploits: 4; Metasploit, Exploit-DB

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

Patch / fix

cisa required action The impacted product is end-of-life and should be disconnected if still in use.

Timeline

2017-02-25 First public exploit (Metasploit exploit/linux/http/netgear_dnslookup_cmd_exec)
2017-03-06 Published
2022-03-25 Added to CISA KEV
2022-04-15 CISA patch deadline
2025-02-04 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-03-25)
Patch by: 2022-04-15 (4 y ago)
Ransomware: Not known
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Vendor, product: NETGEAR, DGN2200 Devices
CISA name: NETGEAR DGN2200 Devices OS Command Injection Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 21 mo ago (2025-02-04)

Exploit prediction

72.64% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/linux/http/netgear_dnslookup_cmd_exec Netgear DGN2200 dnslookup.cgi Command Injection metasploit exploit, excellent rank, 2017-02-25
EDB-42257 Netgear DGN2200 - 'dnslookup.cgi' Command Injection (Metasploit) remote, 2017-06-26
EDB-41472 Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery webapps, 2017-02-28
EDB-41459 Netgear DGN2200v1/v2/v3/v4 - 'dnslookup.cgi' Remote Command Execution webapps, 2017-02-25

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/41459/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/41472/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/42257/
exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/96463
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6334
government-resource, us-government-resource

Sources

CVE List CVE-2017-6334
NVD CVE-2017-6334

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary