TI-2016-09090 Aliases CVE-2016-11055 GHSA-rxh2-hx5f-x65g

Certain NETGEAR devices are affected by CSRF.

LOW 20CWE-352Published 2020-04-28 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Certain NETGEAR devices are affected by CSRF. This affects CM400 before 2017-01-11, CM600 before 2017-01-11, D1500 before 2017-01-11, D500 before 2017-01-11, DST6501 before 2017-01-11, JNR1010v1 before 2017-01-11, JWNR2000Tv3 before 2017-01-11, JWNR2010v3 before 2017-01-11, PLW1000 before 2017-01-11, PLW1010 before 2017-01-11, WNR500 before 2017-01-11, WNR612v3 before 2017-01-11, N450 before 2017-01-11, and CG3000Dv2 before 2017-01-11.

Why it matters now

EPSS 0.00348 28th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPE	Versions	Role	Vendor
cpe:2.3:o:netgear:cm400_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:cm400:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:cm600_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:cm600:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:d1500_firmware::::::::	before 1.0.0.20	Vulnerable	NETGEAR
cpe:2.3:h:netgear:d1500:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:d500_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:d500:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:dst6501_firmware::::::::	before 1.0.0.36	Vulnerable	NETGEAR
cpe:2.3:h:netgear:dst6501:-:::::::*	not specified by NVD	Running on	NETGEAR

cpe:2.3:o:netgear:cm400_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:cm400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:cm600_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:cm600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:d1500_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.20 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:d1500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:d500_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:d500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:dst6501_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.36 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:dst6501:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Show 16 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:netgear:jnr1010_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:jnr1010:v1:::::::*	v1	Running on	NETGEAR
cpe:2.3:o:netgear:jwnr2000t_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:jwnr2000t:v3:::::::*	v3	Running on	NETGEAR
cpe:2.3:o:netgear:jwnr2010_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:jwnr2010:v3:::::::*	v3	Running on	NETGEAR
cpe:2.3:o:netgear:plw1000_firmware::::::::	before 1.0.0.22	Vulnerable	NETGEAR
cpe:2.3:h:netgear:plw1000:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:plw1010_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:plw1010:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:wnr500_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:wnr500:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:wnr612_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:wnr612:v3:::::::*	v3	Running on	NETGEAR
cpe:2.3:o:netgear:n450_cg3000d_firmware::::::::	before 2017-01-11	Vulnerable	NETGEAR
cpe:2.3:h:netgear:n450_cg3000d:v2:::::::*	v2	Running on	NETGEAR

cpe:2.3:o:netgear:jnr1010_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:jnr1010:v1:*:*:*:*:*:*:* Versions v1 Running on ·NETGEAR
cpe:2.3:o:netgear:jwnr2000t_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:jwnr2000t:v3:*:*:*:*:*:*:* Versions v3 Running on ·NETGEAR
cpe:2.3:o:netgear:jwnr2010_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:jwnr2010:v3:*:*:*:*:*:*:* Versions v3 Running on ·NETGEAR
cpe:2.3:o:netgear:plw1000_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.22 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:plw1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:plw1010_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:plw1010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:wnr500_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:wnr500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:wnr612_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:wnr612:v3:*:*:*:*:*:*:* Versions v3 Running on ·NETGEAR
cpe:2.3:o:netgear:n450_cg3000d_firmware:*:*:*:*:*:*:*:* Versions before 2017-01-11 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:n450_cg3000d:v2:*:*:*:*:*:*:* Versions v2 Running on ·NETGEAR

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2016-11055
2026-10-03 Alias added: GHSA-rxh2-hx5f-x65g

References

Advisory 1

https://kb.netgear.com/30114/NETGEAR-Product-Vulnerability-Advisory-CSRF-LocalFile-XSS

TI-2017-14007 Certain NETGEAR devices are affected by slowdown/stoppage. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences