Re: [0-day] RCE and admin credential disclosure in NETGEAR WNR2000

Posted by Pedro Ribeiro on Jan 30

An update on this post:

MITRE has provided me with CVE numbers.
CVE-2016-10175 for #1 (information disclosure)
CVE-2016-10176 for #2 (improper access control)
CVE-2016-10174 for #3 (stack buffer overflow)

In addition, NETGEAR has recognised the flaw and released beta firmware
that is supposed to fix this vulnerability. This claim was NOT verified.
The beta firmware can be downloaded from:…