NETGEAR flaws being used in attacks

CISA lists 8 flaws in NETGEAR products as being used in attacks, most recently on 8 Sep 2022.

What to do

1. Update every NETGEAR product you use.Install the updates NETGEAR offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 8 Sep 2022
   NETGEAR Multiple Devices
   CVE-2017-5521NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
   Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
   CISA’s required actionApply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 8 Jun 2022
   NETGEAR Multiple Devices
   CVE-2017-6862NETGEAR Multiple Devices Buffer Overflow Vulnerability
   Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 25 Mar 2022
   NETGEAR DGN2200 Devices
   CVE-2017-6334NETGEAR DGN2200 Devices OS Command Injection Vulnerability
   dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
   CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 25 Mar 2022
   NETGEAR WNR2000v5 Router
   CVE-2016-10174NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
   The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 25 Mar 2022
   NETGEAR Wireless Access Point (WAP) Devices
   CVE-2016-1555NETGEAR Multiple WAP Devices Command Injection Vulnerability
   Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
6. Being used in attacksAdded by CISA on 7 Mar 2022
   NETGEAR Wireless Router DGN2200
   CVE-2017-6077NETGEAR DGN2200 Remote Code Execution Vulnerability
   NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
7. Being used in attacksAdded by CISA on 7 Mar 2022
   NETGEAR Multiple Routers
   CVE-2016-6277NETGEAR Multiple Routers Remote Code Execution Vulnerability
   NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
8. Being used in attacksAdded by CISA on 3 Nov 2021
   NETGEAR JGS516PE Devices
   CVE-2020-26919Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
   Netgear JGS516PE devices contain a missing function level access control vulnerability.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. NETGEAR on CISA’s site.