CVEs-PoC/2016/CVE-2016-10175.md

### [CVE-2016-10175](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10175)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.

### POC

#### Reference
- http://seclists.org/fulldisclosure/2016/Dec/72
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt
- https://www.exploit-db.com/exploits/40949/

#### Github
No PoCs found on GitHub currently.