CVE-2017-6862: NETGEAR WNR2000 routers authentication bypass and buffer overflow RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with CVSS 9.8 and confirmed exploitation in CISA KEV.

What it is

NETGEAR WNR2000v3, v4 and v5 routers before their fixed firmware versions contain a buffer overflow in a parameter handled by the administration webapp, which also allows authentication bypass. Because the flaw is reachable over the network without credentials, it exposes affected routers to remote code execution and full device compromise.

Impact

An unauthenticated attacker can bypass authentication and execute arbitrary code on the router, gaining full control of the device and its network position.

Attack surface

The flaw is reached remotely through the administration webapp over the network, per the CVSS vector AV:N/PR:N/UI:N, so no authentication or user interaction is required.

Exploitation

CVE-2017-6862 is listed in CISA KEV (added 2022-06-08), indicating known exploitation, and EPSS gives a 30-day probability of roughly 0.43 (98.6th percentile); no ransomware campaign use is documented.

What to do

• Update WNR2000v3 to 1.1.2.14 or later, WNR2000v4 to 1.0.0.66 or later, and WNR2000v5 to 1.0.0.42 or later per the NETGEAR advisory.
• If the device cannot be patched, replace it or remove it from production use.
• Disable remote administration and restrict the admin web interface to trusted internal networks only.
• Segment or isolate the router so a compromise cannot reach other internal systems.

Detection

• Monitor router and perimeter logs for unexpected requests to the administration webapp, especially malformed or oversized parameters.
• Alert on unexpected outbound connections or configuration changes originating from the router.
• Check firmware versions of deployed WNR2000v3/v4/v5 devices against the fixed versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.