NETGEAR WN604 - RCE (CVE-2016-1555)
Description
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in NETGEAR WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
psychologyCrowdSec Analysis
CVE-2016-1555 is a critical vulnerability affecting certain NETGEAR devices, allowing remote attackers to execute arbitrary commands by exploiting weaknesses in how sensitive PHP endpoints handle user input.
CrowdSec has been tracking this vulnerability and its exploits since 4th of June 2024.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2016-1555 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2016-1555 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Exploitation attempts typically involve requests to URLs containing /boarddataww.php.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2017-04-21 |
| CISA KEV | 2022-03-25 |
| CISA Remediation Deadline | 2022-04-15 |
| Rule Released | 2024-06-04 |
| CrowdSec First Seen | 2024-11-23 |