CVE-2017-6334

This Metasploit module exploits a command injection vulnerability in NETGEAR DGN2200 routers by sending a crafted POST request to the dnslookup.cgi endpoint with valid credentials. The payload is executed via the host_name parameter.

This exploit leverages a command injection vulnerability in Netgear routers via the dnslookup.cgi endpoint. It allows authenticated users to execute arbitrary commands by appending them to the host_name parameter, bypassing basic sanitization.

This exploit demonstrates a CSRF vulnerability in NETGEAR DGN2200 routers that, when chained with CVE-2017-6334, allows unauthenticated remote code execution by tricking an authenticated user into visiting a malicious webpage. The payload injects a command into the DNS lookup functionality to trigger a reboot.

This Metasploit module exploits a command injection vulnerability in NETGEAR DGN2200 routers by sending a crafted POST request to the dnslookup.cgi endpoint with valid credentials. The payload is appended to the host_name parameter, allowing remote command execution.