CVE-2016-10174: Technical Deep-Dive (Auto Refreshed)

Generated on 2026-03-31T17:10:22.650Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).

Executive Technical Summary

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

• Context preserved from previous revision: The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution. Notes: Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

Technical Details

• CVE: CVE-2016-10174
• KEV date added: 2022-03-25
• KEV due date: 2022-04-15
• NVD published: 2017-01-30
• NVD modified: 2025-10-22
• MITRE modified: 2025-10-21
• CVSS base score: 9.8
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• CVSS exploitability score: 3.9
• CVSS impact score: 5.9
• Attack vector: Network
• Attack complexity: Low
• Privileges required: None
• User interaction: None
• Scope: Unchanged
• Confidentiality impact: High
• Integrity impact: High
• Availability impact: High

Versions and Products Impacted

• netgear / d6100 firmware
• netgear / d7000 firmware
• netgear / d7800 firmware
• netgear / jnr1010v2 firmware
• netgear / jnr3300 firmware
• netgear / jwnr2010v5 firmware
• netgear / r2000 firmware
• netgear / r6100 firmware
• netgear / r6220 firmware
• netgear / r7500 firmware
• netgear / r7500v2 firmware
• netgear / wndr3700v4 firmware
• netgear / wndr3800 firmware
• netgear / wndr4300 firmware
• netgear / wndr4300v2 firmware
• netgear / wndr4500v3 firmware
• netgear / wndr4700 firmware
• netgear / wnr1000v2 firmware
• netgear / wnr1000v4 firmware
• netgear / wnr2000v3 firmware

Weakness Classification

• CWE-120

Repositories for Lab Validation (Public Examples)

• Ostorlab/KEV | stars: 608 | updated: 2026-03-23 | https://github.com/Ostorlab/KEV
  Notes: Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.
• jweny/pocassistdb | stars: 85 | updated: 2026-01-14 | https://github.com/jweny/pocassistdb
  Notes: database of pocassist（漏洞库）
• 0ps/pocassistdb | stars: 16 | updated: 2025-01-27 | https://github.com/0ps/pocassistdb
  Notes: database of pocassist（漏洞库）

People and Organizations Mentioned

• mitre
• NETGEAR
• WNR2000v5 Router
• Ostorlab
• jweny
• 0ps

Practical Defensive Validation (Authorized Only)

1. Use only isolated environments and systems you own or are explicitly authorized to test.
2. Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
3. Use netgear / d6100 firmware in isolated VM snapshots (vulnerable vs patched) and compare process tree telemetry before/after updates.
4. Validate command-execution prevention policies (AppLocker/WDAC/EDR) with harmless test binaries only.
5. Create SIEM detections for suspicious parent-child chains, encoded command usage, and abnormal service creation.

References

• NVD record: https://nvd.nist.gov/vuln/detail/CVE-2016-10174
• MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2016-10174
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• KEV notes: https://nvd.nist.gov/vuln/detail/CVE-2016-10174
• http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability
• http://seclists.org/fulldisclosure/2016/Dec/72
• http://www.securityfocus.com/bid/95867
• https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
• https://www.exploit-db.com/exploits/40949/
• https://www.exploit-db.com/exploits/41719/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10174
• Repository example: https://github.com/Ostorlab/KEV
• Repository example: https://github.com/jweny/pocassistdb
• Repository example: https://github.com/0ps/pocassistdb

This content is for defensive security training and authorized validation only.