CVE-2017-6334

8.8 highKEVEPSS 73%

High (8.8) in NETGEAR DGN2200 Devices. In CISA KEV since 2022-03-25. EPSS 73% chance of exploitation in the next 30 days.

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 73% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2022-03-25, due 2022-04-15
CWE: CWE-78
Published: 2017-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

netgear:dgn2200_series_firmware

References

http://www.securityfocus.com/bid/96463
https://www.exploit-db.com/exploits/41459/
https://www.exploit-db.com/exploits/41472/
https://www.exploit-db.com/exploits/42257/
http://www.securityfocus.com/bid/96463

Check your stack JSON