CVE-2016-10174: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 83.3% chance of exploitation in the next 30 days.

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

Affected products

  • NETGEAR d6100 Firmware: affected versions not specified
  • NETGEAR d7000 Firmware: affected versions not specified
  • NETGEAR d7800 Firmware: affected versions not specified
  • NETGEAR JNR1010V2 Firmware: affected versions not specified
  • NETGEAR JNR3300 Firmware: affected versions not specified
  • NETGEAR JWNR2010V5 Firmware: affected versions not specified
  • NETGEAR r2000 Firmware: affected versions not specified
  • NETGEAR r6100 Firmware: affected versions not specified
  • NETGEAR r6220 Firmware: affected versions not specified
  • NETGEAR r7500 Firmware: affected versions not specified
  • NETGEAR r7500v2 Firmware: affected versions not specified
  • NETGEAR WNDR3700V4 Firmware: affected versions not specified
  • NETGEAR WNDR3800 Firmware: affected versions not specified
  • NETGEAR WNDR4300 Firmware: affected versions not specified
  • NETGEAR WNDR4300V2 Firmware: affected versions not specified
  • NETGEAR WNDR4500V3 Firmware: affected versions not specified
  • NETGEAR WNDR4700 Firmware: affected versions not specified
  • NETGEAR WNR1000V2 Firmware: affected versions not specified
  • NETGEAR WNR1000V4 Firmware: affected versions not specified
  • NETGEAR WNR2000V3 Firmware: affected versions not specified
  • NETGEAR WNR2000V4 Firmware: affected versions not specified
  • NETGEAR WNR2000v5 Firmware: affected versions not specified
  • NETGEAR WNR2020 Firmware: affected versions not specified
  • NETGEAR WNR2050 Firmware: affected versions not specified
  • NETGEAR WNR2200 Firmware: affected versions not specified
  • and 3 more

Published 2017-01-30. Last modified 2026-06-17.