# CVE-2016-1555: NETGEAR WN604 - RCE

> Live exploitation tracking for CVE-2016-1555 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2016-1555

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** NETGEAR WN604, NETGEAR WN802Tv2, NETGEAR WNAP210v2, NETGEAR WNAP320, NETGEAR WNDAP350, NETGEAR WNDAP360, NETGEAR WNDAP660
- **Weaknesses:** CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
- **Tags:** iot

## Description

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in NETGEAR WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

## CrowdSec analysis

[CVE-2016-1555](https://euvd.enisa.europa.eu/vulnerability/CVE-2016-1555) is a critical vulnerability affecting certain NETGEAR devices, allowing remote attackers to execute arbitrary commands by exploiting weaknesses in how sensitive PHP endpoints handle user input.

CrowdSec has been tracking this vulnerability and its exploits since 4th of June 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2016-1555 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
In addition, according to the CrowdSec network, attack volume against CVE-2016-1555 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Exploitation attempts typically involve requests to URLs containing `/boarddataww.php`.

## Timeline

- 2017-04-21: CVE Published. CVE-2016-1555 is published to NVD.
- 2022-03-25: CISA KEV. CVE-2016-1555 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-04-15: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-06-04: Rule Released. CrowdSec releases a rule to detect CVE-2016-1555 exploitation attempts against the CrowdSec Network.
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2016-1555 for the first time.

## References

- https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1555.yaml
- https://www.exploit-db.com/exploits/45909/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2016-1555) follows observed exploitation activity for CVE-2016-1555. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.