CVE-2016-10174

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when...

9.8 CriticalIn KEVPublic exploit

CVE-2016-10174 is a critical vulnerability (CVSS 9.8) in Netgear Wnr2000v5 Router, published January 30, 2017. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.3%, the 99th percentile. No source names a fixed version.

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

83.3%Down 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2016-10174
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-120
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2016-10174
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

EUVDEUVD-2016-1361 9.8

Record: EUVD-2016-1361
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rgmj-9q73-5phf 9.8

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when...

Record: GHSA-rgmj-9q73-5phf
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-120
Updated: 2026-11-02

CISA KEV No score

NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.

Record: CVE-2016-10174
Weakness: CWE-119
Updated: 2026-11-02

Affected products

Show 17 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	NETGEAR WNR2000v5 (Un)authenticated hidden_lang_avi Stack Buffer Overflow	2016-12-20
Exploit-DB	Netgear WNR2000v5 - Remote Code Execution	2016-12-21
Exploit-DB	Netgear WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit)	2017-03-24

History

History
When	Changed	Sources
2026-11-03	exploitation, exploits
2026-11-02	created	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD