CVE-2016-11057

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-28 · updated 2026-06-17
Weakness: CWE-287

Description

Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2020v2 before 2017-01-06, R6220 before 2017-01-06, and WNDR3700v5 before 2017-01-06.

Affected products

NETGEAR Jnr1010 Firmware: before 2017-01-06 — fixed in 2017-01-06
NETGEAR Jwnr2000 Firmware: before 2017-01-06 — fixed in 2017-01-06
NETGEAR Jwnr2010 Firmware: before 2017-01-06 — fixed in 2017-01-06
NETGEAR R6220 Firmware: before 2017-01-06 — fixed in 2017-01-06
NETGEAR Wndr3700 Firmware: before 2017-01-06 — fixed in 2017-01-06
NETGEAR Wnr1000 Firmware: before 2017-01-06 — fixed in 2017-01-06
NETGEAR Wnr2020 Firmware: before 2017-01-06 — fixed in 2017-01-06
Netgear WNR614: before 2017-01-06 — fixed in 2017-01-06
NETGEAR Wnr618 Firmware: before 2017-01-06 — fixed in 2017-01-06

How to fix

Upgrade to a fixed version: NETGEAR Jnr1010 Firmware 2017-01-06; NETGEAR Jwnr2000 Firmware 2017-01-06; NETGEAR Jwnr2010 Firmware 2017-01-06; NETGEAR R6220 Firmware 2017-01-06; NETGEAR Wndr3700 Firmware 2017-01-06; NETGEAR Wnr1000 Firmware 2017-01-06; NETGEAR Wnr2020 Firmware 2017-01-06; Netgear WNR614 2017-01-06; NETGEAR Wnr618 Firmware 2017-01-06. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-11057 or the next vulnerability affects your stack