Vulnerability record · CVE-2017-6334 · published 6 March 2017
CVE-2017-6334: NETGEAR DGN2200 dnslookup.cgi OS Command Injection
Netgear · Dgn2200 Series Firmware
The dnslookup.cgi script on NETGEAR DGN2200 devices running firmware through 10.0.0.50 fails to sanitize the host_name field of an HTTP POST request, allowing OS command injection. An attacker who can authenticate to the device can run arbitrary commands on the underlying operating system, and the product is end-of-life with no vendor fix expected.
Description
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityThe flaw allows authenticated remote OS command execution on an end-of-life device, is listed in CISA KEV, has public exploits, and carries a very high EPSS score.
What it is
The dnslookup.cgi script on NETGEAR DGN2200 devices running firmware through 10.0.0.50 fails to sanitize the host_name field of an HTTP POST request, allowing OS command injection. An attacker who can authenticate to the device can run arbitrary commands on the underlying operating system, and the product is end-of-life with no vendor fix expected.
Impact
An authenticated attacker gains arbitrary OS command execution on the router, enabling full device compromise, credential theft, traffic interception, and use of the device as a foothold into the network.
Attack surface
Reachable over the network via an HTTP POST to dnslookup.cgi; the CVSS vector (AV:N/PR:L/UI:N) indicates valid credentials are required and no user interaction is needed.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-25, and public Exploit-DB entries exist; EPSS is 0.72199 (99.4th percentile), indicating high likelihood of exploitation activity.
What to do
- Retire or replace affected DGN2200 devices, which are end-of-life; CISA directs disconnecting them if still in use.
- If the device must remain, isolate it on a segmented network with no access to sensitive systems and restrict management access to trusted hosts.
- Change default and weak administrative credentials and enforce strong, unique passwords to limit the authenticated attack path.
- Monitor vendor channels for any firmware update, though none is expected for this end-of-life product.
Detection
- Inspect HTTP POST requests to dnslookup.cgi for shell metacharacters (;, |, &, $(), backticks) in the host_name parameter.
- Alert on unexpected outbound connections or processes spawned from the router's management interface.
- Review router authentication logs for logins from unusual source addresses preceding dnslookup.cgi requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-6334 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "NETGEAR DGN2200 Devices OS Command Injection Vulnerability". Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 15 April 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/96463 | Broken LinkThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/41459/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/41472/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42257/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/96463 | Broken LinkThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/41459/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/41472/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42257/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6334 | US Government Resource |
Track CVE-2017-6334 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-6334), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
