CVE-2016-5649

Netgear DGN2200 and DGND3700 disclose the administrator password

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.09.8Critical EPSS percentile98th24% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2018-07-24Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your router model and current firmware version in the router’s web interface (look for the firmware version for DGN2200 or DGND3700).
If you have affected firmware, upgrade to the vendor-fixed firmware: DGN2200 to 1.0.0.52 and DGND3700 to 1.0.0.28.
After updating, change the router’s administrator password to a new, strong password.
If your router is exposed to the internet, verify any “remote management”/WAN administration settings are disabled, so the router’s admin interface can’t be reached externally.

Some work to apply

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.

In plain language

Written by AI from the record

If you use a Netgear DGN2200 or DGND3700, an attacker may be able to view the router’s administrator password over the network and take over the web admin page; you should update your firmware now if your router is reachable from the internet.

CVE-2016-5649 affects Netgear DGN2200 and DGND3700 firmware where a remotely reachable web page discloses the administrator password in clear text, enabling an attacker to log in as an administrator via the router’s web interface.

If you're affected

Full router admin takeover
Traffic redirection/man-in-the-middle
Service disruption
Credential compromise risk

What is it

This bug can accidentally “show” the router’s administrator password to someone who reaches a particular page on the router. It’s like leaving the key to a locked office taped to the door—then using that key to enter the office and change settings.

Who is affected

This matters if your small business uses a Netgear DGN2200 or DGND3700 router that is running affected firmware. The risk is specifically tied to an attacker reaching the exposed router page without authentication, so it’s most concerning when the router is reachable from the internet (for example, if remote/WAN administration is enabled).

How urgent is it

This is an attacker-friendly issue with a public exploit available, meaning real-world misuse is practical. Because the password can be exposed in clear text, you should treat this as a high-priority patch (amber) if the router could be accessed from outside your network.

What to do — in detail

Confirm exposure (quick checks)
- Identify every device in your business network that is a Netgear DGN2200 or DGND3700.
- In each router’s web interface, note the firmware version.
- Compare to the vendor-fixed versions referenced by the patch information.
Upgrade to the fixed firmware
- For DGN2200: upgrade to firmware version 1.0.0.52.
- For DGND3700: upgrade to firmware version 1.0.0.28.
- Plan for a reboot during the firmware upgrade.
Reset/rotate credentials after patching
- After the update completes, change the router administrator password to a brand-new strong password.
- If you reuse passwords anywhere else (same password on Wi-Fi, email, or other systems), change those too to reduce reuse risk.
Reduce external reachability (temporary risk reduction if patching is delayed)
- If you have any setting that allows remote administration, WAN-based management, or admin access from the internet, disable it.
- Ensure the router admin page is only accessible from your internal network.
Validate nothing else is affected
- Re-check the firmware versions after upgrading.
- If you see unexpected admin logins or changes to network settings, consider further incident steps (review router logs, review DNS settings, and inspect for unusual network changes).
Monitor
- Watch for repeated login attempts or configuration changes in router logs after the change.

KEV note: this CVE is not listed in CISA KEV based on the provided findings, so urgency is driven by the presence of a public exploit and the password exposure mechanism rather than KEV-listed exploitation.

Technical context

Severity is extremely high in scoring terms (reported as 9.8), but the practical risk for a business depends on reachability. The weakness involves a remotely accessible router web page that does not require authentication; when accessed, it exposes the administrator password in clear text before redirecting.

Attack vector: network-based access to the specific router web page (no authentication required). Mechanism: clear-text password disclosure followed by use of that password to obtain administrator access to the router’s web interface.

Exploitation status: a public exploit is available (2 known), indicating exploitability is not theoretical.

Patch: vendor firmware releases are available to address the issue (DGN2200 1.0.0.52; DGND3700 1.0.0.28). KEV is not listed for this CVE per the findings provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

24% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

unknown.

Real risk signals with little public attention so far.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

Netgearcommercial · USaka net gear

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

CollectionT1005Data from Local Systemmedium confidence T1557Adversary-in-the-Middlehigh confidence
Credential AccessT1040Network Sniffinghigh confidence

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Dgn2200 Firmware, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account