CVE-2016-10176

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.

• CWE-20

• http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-VulnerabilityPatch, Vendor Advisory
• http://seclists.org/fulldisclosure/2016/Dec/72Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/95867Third Party Advisory, VDB Entry
• https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txtExploit, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/40949/
• http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-VulnerabilityPatch, Vendor Advisory
• http://seclists.org/fulldisclosure/2016/Dec/72Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/95867Third Party Advisory, VDB Entry
• https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txtExploit, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/40949/

Published

Jan 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10170The WriteCaffHeader function in cli/caff.c in Wavpack before…
• CVE-2016-10171The unreorder_channels function in cli/wvunpack.c in Wavpack…
• CVE-2016-10172The read_new_config_info function in open_utils.c in Wavpack…
• CVE-2016-10173Directory traversal vulnerability in the minitar before 0.6 …
• CVE-2016-10174The NETGEAR WNR2000v5 router contains a buffer overflow in t…9.8
• CVE-2016-10175The NETGEAR WNR2000v5 router leaks its serial number when pe…
• CVE-2016-10177An issue was discovered on the D-Link DWR-932B router. Undoc…9.8
• CVE-2016-10178An issue was discovered on the D-Link DWR-932B router. HELOD…9.8
• CVE-2016-10179An issue was discovered on the D-Link DWR-932B router. There…7.5
• CVE-2016-1018Stack-based buffer overflow in Adobe Flash Player before 18.…8.8
• CVE-2016-10180An issue was discovered on the D-Link DWR-932B router. WPS P…7.5
• CVE-2016-10181An issue was discovered on the D-Link DWR-932B router. qmiwe…7.5