The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2016/Dec/72 | exploit mailing list vdb entry third party advisory |
| https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt | exploit technical description third party advisory |
| http://www.securityfocus.com/bid/95867 | vdb entry broken link third party advisory |
| https://www.exploit-db.com/exploits/41719/ | exploit vdb entry third party advisory |
| http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability | vendor advisory |
| https://www.exploit-db.com/exploits/40949/ | exploit vdb entry third party advisory |