Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV·Added 2022-03-25 — agencies required to remediate by 2022-04-15

CVE-2016-10174

CRITICAL

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by…

Published
Jan 30, 2017
Updated
Apr 21, 2026
Affected
0 pkgs
Patched
None yet
Exploits
8 known

EPSS Exploitation Probability

via FIRST.org ↗
91.1%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
89.3%90.0%90.8%91.6%91.1%91.1%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Description

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

Affected Products

28 products · 28 configurations
OS
d6100 firmwarenetgear
all
OS
d7000 firmwarenetgear
all
OS
d7800 firmwarenetgear
all
OS
jnr1010v2 firmwarenetgear
all
OS
jnr3300 firmwarenetgear
all
OS
jwnr2010v5 firmwarenetgear
all
Exploits & PoCs
8

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-40949remotecgi

Netgear WNR2000v5 - Remote Code Execution

by Pedro Ribeiro · Dec 21, 2016

EDB-41719remotehardware✓ Verified

Netgear WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit)

by Pedro Ribeiro · Mar 24, 2017

Frequently Asked Questions

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
O3 Security · Impact-Aware SCA

Is CVE-2016-10174 in your stack?

O3 detects CVE-2016-10174 across dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.