The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2016/Dec/72 | mailing list vdb entry exploit third party advisory |
| https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt | third party advisory exploit technical description |
| http://www.securityfocus.com/bid/95867 | broken link third party advisory vdb entry |
| https://www.exploit-db.com/exploits/41719/ | third party advisory vdb entry exploit |
| http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability | vendor advisory |
| https://www.exploit-db.com/exploits/40949/ | third party advisory vdb entry exploit |