Is CVE-2017-6334 (NETGEAR DGN2200 Devices OS Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2017-6334 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands

What KEV Listing Means for This NETGEAR DGN2200 Flaw

CISA’s KEV listing is the practical signal that matters most here: it means the flaw is not just theoretically exploitable, but has credible evidence of active abuse in the wild. For defenders, that changes the response from routine patch planning to immediate exposure confirmation, containment, and prioritised remediation.

For this device class, the right question is not whether the bug exists in the abstract, but whether any DGN2200 instance is still reachable, still supported, and still trusted in a live environment. A router or gateway that remains online after a KEV listing should be treated as a high-priority internet-facing risk until proven otherwise.

How to Check Exposure and Reduce Blast Radius

Start by identifying every NETGEAR DGN2200 unit, its firmware level, and whether it is exposed to untrusted networks. Even when a flaw requires authenticated access, the exposed login surface still matters because a weak, reused, or inherited admin credential can turn a local bug into a remote foothold.

Then reduce blast radius before or while you remediate. Remove unnecessary management exposure, restrict administrative access to trusted networks, and verify whether the device is still used for any critical routing or remote-access function. If it is acting as an edge device in a small office or home environment, assume compromise potential is higher because these systems often have limited monitoring and poor change control.

What Practitioners Should Do When Patching Cannot Happen Immediately

If you cannot replace or remediate the device right away, treat the gap as a temporary exception with compensating controls, not as a deferred ticket. The most useful interim steps are to isolate the device, limit who can authenticate to it, and monitor for unusual management activity or unexpected outbound traffic.

For a router flaw like this, the operational reality is that patch delay often creates more risk than the vulnerability itself if the device remains internet-reachable. The vendor advisory and the CISA Known Exploited Vulnerabilities Catalog should be your source of truth for remediation status, while CVE Program and NIST National Vulnerability Database remain useful references for record verification and product context.

Risk and Threat Considerations

Because the flaw allows OS command execution on a network device, the main risks are device takeover, traffic manipulation, and follow-on access into the local network. A compromised edge device can become a pivot point, a surveillance point, or a persistence point, especially if it sits outside normal endpoint monitoring.

Failure mechanism: An attacker who can satisfy the authentication requirement can submit commands through the vulnerable interface and use the device’s own trust position to execute code, alter configuration, or stage additional access.

Impact: The result can include interception or redirection of traffic, loss of administrative control, and exposure of downstream systems that rely on the router for segmentation or basic perimeter enforcement.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed flaws need continuous exposure and remediation tracking.
	SI-2 — Flaw Remediation	The question is about an exploited vulnerability requiring prompt correction.
Recommendation — Prioritise remediation of KEV-listed assets and verify exposure with authenticated scanning. Remediate the vulnerable device or remove it from service as soon as possible.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires prioritised vulnerability handling and exception control.
Recommendation — Track the device as a high-priority vulnerability and close the gap quickly.
NIST CSF 2.0	PR.PS-01 — Configuration Management	Edge device exposure depends on secure configuration and limiting unnecessary access paths.
Recommendation — Harden management access and restrict the device to approved network paths.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The flaw is an externally reachable command-injection exploitation path.
Recommendation — Map the vulnerable interface to T1190 and hunt for exploitation attempts.

Practitioner Guidance

What to prioritise: Confirm whether any DGN2200 device is still active, still reachable from untrusted networks, and still needed. If it is business-critical, treat it as a temporary containment problem first and a replacement problem second.

What to verify: Check whether the device has been exposed to the internet, whether management access is restricted, and whether any administrative credentials may be shared, reused, or no longer governed. For a KEV-listed edge device, exposure plus weak administration is the combination that most often turns a known flaw into an incident.

Practitioner takeaway: For an actively exploited router flaw, the decision is rarely “patch later or not”, it is “remove exposure, confirm no compromise, and eliminate the device if it cannot be trusted under current operating conditions.”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org