CVE-2017-6077

ping.cgi on NETGEAR DGN2200 routers running firmware through version 10.0.0.50 fails to sanitize the ping_IPAddr field of HTTP POST requests, allowing shell metacharacters to inject arbitrary operating-system commands (CWE-78, OS command injection). Per the vulnerability description, an attacker needs authenticated access to the router's web interface to send the crafted POST request, although the CVSS vector treats the flaw as exploitable over the network without privileges — significant because many deployed routers use default or weak admin credentials. Successful exploitation yields arbitrary command execution on the device, enabling full router compromise, manipulation of DNS or routing, interception of traffic, and pivoting into the local network. All NETGEAR DGN2200 (Wireless Router) units on affected firmware are exposed, particularly those with the management interface reachable from the WAN. The flaw is actively exploited: it was added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-07, carries a high exploitation probability (EPSS 68.2%, 99th percentile), and a public proof-of-concept is available (Exploit-DB 41394).

What to do: Upgrade DGN2200 firmware to a version later than 10.0.0.50 per NETGEAR's guidance, as required by the CISA KEV listing; if the device is end-of-life and no fixed firmware is available, plan replacement. As interim mitigations, disable WAN-side remote management, restrict the admin interface to trusted hosts, and replace default credentials, since authenticated access is the trigger. Check web server logs for HTTP POST requests to ping.cgi containing shell metacharacters in the ping_IPAddr parameter.