CVE-2016-10176

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jan 30, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-101779.8An issue was discovered on the D-Link DWR-932B router. Undocumented TELNET and SSH services provide logins to admin with the password admin CVE-2016-101789.8An issue was discovered on the D-Link DWR-932B router. HELODBG on port 39889 (UDP) launches the "/sbin/telnetd -l /bin/sh" command.CVE-2016-101797.5An issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607.CVE-2016-10188.8Stack-based buffer overflow in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 1CVE-2016-101807.5An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.CVE-2016-101817.5An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests.CVE-2016-101829.8An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.CVE-2016-101837.5An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal.CVE-2016-101847.5An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal.CVE-2016-101857.5An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf.CVE-2016-101867.5An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules.CVE-2016-101875.5The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.