Volerion logoVolerion
Volerion logoVolerion

Netgear D6400 OS Command Injection Vulnerability in diag.cgi

Vulnerability

A critical OS command injection vulnerability has been identified in the Netgear D6400 router, specifically in version 1.0.0.114. The issue arises in the diag.cgi file, where the host_name argument can be manipulated to execute arbitrary OS commands. This vulnerability can be exploited remotely and affects products that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a crafted request to the router's diag.cgi file, manipulating the host_name argument. This can be done remotely, targeting the Netgear D6400 router running firmware version 1.0.0.114.

Remediation

Users are advised to replace the affected component with an alternative, as this vulnerability affects an unsupported product.

Added: Jul 10, 2025, 2:25 PM
Updated: Jul 10, 2025, 2:25 PM

Vulnerability Rating

Custom Algorithm
spread
0.3
impact
7.5
exploitability
6.2
remediation
0.0
relevance
0.2
threat
6.5
urgency
2.9
incentive
0.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.