CVE-2016-10174

The NETGEAR WNR2000v5 router contains a buffer overflow (CWE-120) in the hidden_lang_avi parameter processed by the /apply.cgi?/lang_check.html language-check endpoint. An unauthenticated attacker can send an HTTP request with an oversized hidden_lang_avi value to this URL, overflowing a fixed-size buffer and overwriting memory. Successful exploitation yields pre-authentication remote code execution and full compromise of the device (CVSS 3.1 9.8: network vector, low complexity, no privileges or user interaction, high confidentiality/integrity/availability impact). CISA's affected list names the WNR2000v5 router specifically, while the NVD CPE associations additionally cover other NETGEAR firmware products (D6100, D7000, D7800, JNR1010v2, JNR3300, JWNR2010v5, R2000, R6100, R6220, R7500, R7500v2, WNDR3700v4). The flaw is under active exploitation: it was added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-25 (ransomware use unknown per CISA), EPSS assigns an 83.5% probability of exploitation within 30 days (100th percentile), and four public PoC/exploit references are available.

What to do: Upgrade affected WNR2000v5 routers to the latest NETGEAR-supplied firmware per the vendor's instructions (the CISA KEV required action); unpatched or end-of-life units should be replaced. As an interim mitigation, disable or restrict WAN-facing web/remote management so /apply.cgi?/lang_check.html is not reachable from untrusted networks, and review device logs for oversized hidden_lang_avi requests to that endpoint. Given confirmed in-the-wild exploitation, check exposed devices for signs of compromise.