CVE-2017-6334

What it actually does

Remote authenticated command injection in dnslookup.cgi allowing arbitrary OS command execution via shell metacharacters in the host_name POST parameter on affected NETGEAR DGN2200 firmware.

Why it matters to the business

Attackers with valid credentials can fully compromise the router, enabling persistent network access, traffic interception, or use as a pivot point; the device remains listed in CISA KEV with a 2022 remediation deadline and continues to see active exploitation despite its age.

How an attack unfolds

An attacker first obtains valid credentials for the router's web interface, then crafts an HTTP POST to /dnslookup.cgi containing shell metacharacters inside the host_name field to execute operating-system commands, achieving code execution on the device.

How to fix it

Replace the affected DGN2200 hardware with a supported model; no firmware updates are listed for versions through 10.0.0.50. Immediately restrict web-interface access to trusted networks and disable remote management.

How to confirm the fix worked

Verify device firmware version is newer than 10.0.0.50 or confirm the router model has been replaced; test that dnslookup.cgi no longer accepts metacharacters by submitting a benign command and observing that it is rejected or sanitized.

Typical attack path

1. Obtain valid web-interface credentials via guessing, credential stuffing, or prior compromise
2. Send authenticated HTTP POST to dnslookup.cgi with malicious host_name parameter containing shell metacharacters
3. Execute arbitrary OS commands to read files, modify configuration, or install persistent backdoors
4. Pivot to internal network resources or exfiltrate data through the compromised router

How to detect it

Review web-server access logs for POST requests to dnslookup.cgi containing unusual characters in the host_name field; look for shell command patterns, unexpected process spawns, or configuration changes on the device.

• POST /dnslookup.cgi
• host_name=
• shell metacharacters such as ; ` $ ( )
• unexpected cron entries or modified /etc files after web requests

What your security team should do

• Treat as high-priority due to KEV listing and confirmed in-the-wild exploitation; inventory all DGN2200 devices immediately
• Block or strictly ACL web management interfaces from untrusted networks
• Replace end-of-life DGN2200 units with current supported NETGEAR or alternative hardware
• Monitor for post-exploitation artifacts such as unexpected cron jobs or modified configuration files