OS Command Injection (CVE-2017-6334) in NETGEAR DGN2200 Routers Allows Authenticated Remote Code Execution
What It Is — The vulnerability (CVE‑2017‑6334) is an OS command‑injection flaw in the dnslookup.cgi endpoint of NETGEAR DGN2200 routers. Authenticated remote users can inject and execute arbitrary operating‑system commands on the device.
Exploitability — Requires a valid user account on the router (remote authenticated). Public proof‑of‑concept code exists; no public unauthenticated exploit. CVSS v3.1 base score 7.5 (High).
Affected Products — NETGEAR DGN2200 series routers with firmware versions up to 10.0.0.50.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous verification that device firmware and configuration are current—a core control‑area for secure configuration management.
- Without timely patching, organizations cannot demonstrate due‑diligence in supply‑chain security, weakening audit readiness and defensible evidence for regulators.
- Emphasises the importance of centralized logging of privileged device access to provide a traceable audit trail for enterprise buyers.
Recommended Actions
- Upgrade all DGN2200 units to the latest firmware (≥ 10.0.0.51) or apply NETGEAR’s out‑of‑band patch.
- Inventory all deployed NETGEAR routers and verify firmware versions against a trusted baseline.
- Enable and centralise syslog collection from the devices; monitor for anomalous command‑execution events.
- Map the remediation to the control objective “Secure Configuration Management” and capture evidence in your continuous control‑monitoring platform.
Source: CISA KEV – CVE‑2017‑6334