dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/96463 | vdb entry third party advisory broken link |
| https://www.exploit-db.com/exploits/41459/ | exploit vdb entry third party advisory |
| https://www.exploit-db.com/exploits/41472/ | exploit vdb entry third party advisory |
| https://www.exploit-db.com/exploits/42257/ | exploit vdb entry third party advisory |