CVE-2017-6366

Description

Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi. NOTE: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.247

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2016-11054 ,CVE-2017-6077 ,CVE-2017-6366 are affected in dgn2200_firmware 1.0.0.110	NCM
Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-6366)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234