CVEvulnerability

CVE-2016-1555

9.8 CRITICAL Known exploited Published 2017-04-21 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

NETGEAR Multiple WAP Devices Command Injection Vulnerability — NETGEAR Wireless Access Point (WAP) Devices

Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.

Added to KEV: 2022-03-25
Remediation due: 2022-04-15
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-1555

Status: Analyzed
Published: 2017-04-21
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-77

Description

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

Affected configurations

• netgear wnap320 firmware (<= 3.0.5.0) • netgear wndap350 firmware (<= 3.0.5.0) • netgear wndap360 firmware (<= 3.0.5.0) • netgear wndap210v2 firmware (<= 3.0.5.0) • netgear wn604 firmware (<= 3.3.2) • netgear wndap660 firmware (<= 3.0.5.0) • netgear wn802tv2 firmware (<= 3.0.5.0)

Weakness · CWE (1)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References