Skip to content
Fencer Vulns
critical 9.8

CVE-2016-10176 in the critical feed json

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the de…

published 2017-01-30 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-1363

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
77.4%
EPSS 77.4% chance of exploitation in 30 days, percentile 99.5%
public exploits
2
Metasploit, Exploit-DB

Summary

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.

Patch / fix

Timeline

  1. First public exploit (Metasploit auxiliary/admin/http/netgear_wnr2000_pass_recovery)
  2. Published

Exploit prediction

77.43% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.