CVE-2017-6334

CVE-2017-6334 is a critical command injection vulnerability affecting NETGEAR DGN2200 series routers with firmware through 10.0.0.50. It allows remote authenticated attackers to execute arbitrary OS commands by injecting shell metacharacters into the host_name field of an HTTP POST request to dnslookup.cgi. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. The vulnerability is actively exploited in the wild, as evidenced by its inclusion in the CISA KEV catalog and its use by botnets like BotenaGo and Mirai. Publicly available exploit code, including Metasploit modules and ExploitDB entries, further facilitates its exploitation. The significant community discussion and media coverage highlight the widespread awareness and ongoing threat posed by this flaw.