CVE-2016-1555

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

98.29% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-03-25

Nuclei

critical · CWE-77

Published

2017-04-21

Updated

2025-10-21

Proof-of-concept exploits (1)

• ide0x90/cve-2016-15552★ · 2018-11-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-1555.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_unauth_exec.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/45909

Security advisories

• https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic
• http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Bu…
• http://seclists.org/fulldisclosure/2016/Feb/112

References

• CVE Record
• NVD entry