HowToFixMe
● Critical · CVSS 9.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2017-6862: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚡ At a glance
SeverityCVSS 3.1 base score 9.8 - Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Actively exploited?Yes, listed in CISA KEV (added 2022-06-08)
AffectedNETGEAR WNR2000v3 firmware before 1.1.2.14, WNR2000v4 before 1.0.0.66, WNR2000v5 before 1.0.0.42
Fixed inWNR2000v3 firmware 1.1.2.14 · WNR2000v4 1.0.0.66 · WNR2000v5 1.0.0.42 (NETGEAR PSV-2016-0261)
Type (CWE)CWE-120 Buffer Copy without Checking Size of Input (Classic Buffer Overflow) - unauthenticated remote code execution

Exploitation status

CVE-2017-6862 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “NETGEAR Multiple Devices Buffer Overflow Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: although a public exploit is not directly linked in this CVE’s primary references, its place on the CISA KEV catalog confirms working attack code is in active use in the wild, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-06-08, federal due date 2022-06-22.

What is CVE-2017-6862?

CVE-2017-6862 is a classic buffer overflow (CWE-120) in the web administration interface of three NETGEAR WNR2000 wireless routers: the WNR2000v3, WNR2000v4, and WNR2000v5. A parameter handled by the router's administration web app is copied into a fixed-size buffer without any bounds check. An attacker who sends an oversized value overflows that buffer, which lets them both bypass authentication and run arbitrary code on the router. NETGEAR tracks the issue internally as PSV-2016-0261.

Two things make this flaw severe. First, it is unauthenticated - the attacker does not need the admin password, so exposing the management page to a hostile network is enough. Second, it yields remote code execution on the device itself, not just a crash or a config read. A successful exploit runs with the privileges of the router's web server, which on these consumer routers means full control of the device: DNS settings, firewall rules, traffic interception, and a foothold to pivot into the LAN behind it. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - the highest tier, reflecting network reachability, low attack complexity, no privileges or user interaction required, and total compromise of confidentiality, integrity, and availability.

Why this CVE matters

CISA added CVE-2017-6862 to its Known Exploited Vulnerabilities catalog on 2022-06-08, which only happens once active exploitation is observed in the wild. Internet-exposed home and small-office routers are a standing target for botnet operators precisely because an unauthenticated RCE on the WAN-facing admin interface can be weaponized at scale - CISA's own SSVC assessment for this CVE marks it as actively exploited, automatable, and total in technical impact. If you operate a WNR2000v3, v4, or v5 that was reachable from the internet while unpatched, treat it as potentially compromised: firmware-resident malware on routers survives reboots and is not always visible from the admin UI.

Am I affected?

This CVE applies only to NETGEAR WNR2000 routers, hardware revisions v3, v4, and v5. There is no Linux package or Windows software to check - the vulnerable code is the router's own firmware. You are affected if your firmware is older than the fixed build for your hardware revision:

To find your hardware revision and firmware version, sign in to the router admin page (typically http://192.168.1.1 or http://routerlogin.net) and open Advanced → Administration → Router Status (or Maintenance → Router Status on older builds). The hardware revision is also printed on the product label on the underside of the unit. Compare the firmware version shown there against the list above.

How to fix CVE-2017-6862

The fix is a firmware upgrade to the patched build for your hardware revision. NETGEAR published these in advisory PSV-2016-0261:

All three WNR2000 revisions are long past their end-of-life support window, so the patched firmware above is the final build NETGEAR shipped for them. If the router is still in service, apply it; if you cannot, the device should be retired and replaced - an unpatchable router carrying an actively exploited unauthenticated RCE has no safe place on a network.

Upgrade via the admin interface

  1. Download the patched firmware for your exact model and hardware revision from the NETGEAR support site (search for "WNR2000v3", "WNR2000v4", or "WNR2000v5" and pick the matching firmware version listed above). Do not install firmware for a different hardware revision - it can brick the unit.
  2. Connect a computer to the router over a wired Ethernet cable rather than Wi-Fi, so the connection does not drop mid-flash.
  3. Sign in to the admin page and open Advanced → Administration → Firmware Update (older builds: Maintenance → Router Upgrade).
  4. Browse to the downloaded firmware file, start the update, and do not power off the router until it has finished rebooting. A firmware flash typically takes a few minutes.
  5. After the reboot, return to Router Status and confirm the firmware version now matches the patched build.

Harden after upgrading

Because the device may already have been reached while vulnerable, do the following once the patched firmware is running:

  1. Disable remote (WAN-side) management. Under Advanced → Remote Management, make sure remote administration is turned off so the admin interface is never reachable from the internet.
  2. Change the admin password to a new, strong value. The overflow could expose or bypass credentials, so the old password should be considered compromised.
  3. Review the settings an attacker would tamper with: the DNS servers under Internet/WAN setup, any port-forwarding or DMZ entries, and the firewall rules. Reset anything you do not recognise.
  4. If you have any doubt the device was already breached, perform a factory reset (hold the reset pin for ~10 seconds), then re-flash the patched firmware and reconfigure from scratch rather than restoring a saved backup.

If you can't upgrade immediately

The firmware upgrade is the only real fix. These steps reduce exposure while you schedule it, but they do not remove the vulnerability:

How to verify the fix worked

Confirm the remediation held with three checks:

  1. Firmware version. On the Router Status page, the version must read 1.1.2.14 or later (v3), 1.0.0.66 or later (v4), or 1.0.0.42 or later (v5).
  2. Management reachability. From outside your network, confirm the router's admin page is not reachable on the WAN IP. With remote management disabled, the port should be closed or filtered.
  3. Scanner clearance. Run a network vulnerability scan with a current signature set and confirm it no longer flags CVE-2017-6862 against the device.

If the router was internet-facing and unpatched for any length of time, complete the hardening steps above (password rotation, DNS and firewall review) before considering the incident closed.

Frequently asked questions

Which NETGEAR models and firmware versions does CVE-2017-6862 affect?

Only the WNR2000 router, hardware revisions v3, v4, and v5. The WNR2000v3 is affected below firmware 1.1.2.14, the WNR2000v4 below 1.0.0.66, and the WNR2000v5 below 1.0.0.42. Other NETGEAR models are not in scope of this CVE. Check your hardware revision on the product label and your firmware on the Router Status admin page.

What is the fixed firmware version for my WNR2000?

Upgrade to 1.1.2.14 or later on the WNR2000v3, 1.0.0.66 or later on the WNR2000v4, and 1.0.0.42 or later on the WNR2000v5. These builds, published under NETGEAR advisory PSV-2016-0261, are the final firmware NETGEAR released for these end-of-life routers.

Can an attacker exploit this without my router password?

Yes. The buffer overflow lets an attacker bypass authentication entirely, so no valid credentials are needed. That is why CISA rates it CVSS 9.8 and why disabling WAN-side remote management is critical until the patched firmware is installed.

My WNR2000 is end-of-life. Should I keep using it?

Only if it is running the patched firmware above and remote management is disabled. If you cannot apply the fixed build, retire the router - an unpatchable device carrying an actively exploited unauthenticated RCE should not stay on a network.

References

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related weaknesses in the same component worth addressing at the same time:

People also ask

Which NETGEAR models and firmware versions does CVE-2017-6862 affect?

Only the WNR2000 router, hardware revisions v3, v4, and v5. The WNR2000v3 is affected below firmware 1.1.2.14, the WNR2000v4 below 1.0.0.66, and the WNR2000v5 below 1.0.0.42. Check your hardware revision on the product label and your firmware on the Router Status admin page.

What is the fixed firmware version for my WNR2000?

Upgrade to 1.1.2.14 or later on the WNR2000v3, 1.0.0.66 or later on the WNR2000v4, and 1.0.0.42 or later on the WNR2000v5. These builds, published under NETGEAR advisory PSV-2016-0261, are the final firmware released for these end-of-life routers.

Can an attacker exploit this without my router password?

Yes. The buffer overflow lets an attacker bypass authentication entirely, so no valid credentials are needed. That is why CISA rates it CVSS 9.8 and why disabling WAN-side remote management is critical until the patched firmware is installed.