CVE-2016-1555

NETGEAR WAP devices allowed unauthenticated command injection via web forms, enabling arbitrary code execution.

NETGEAR wireless access points passed unauthenticated form input directly to the command-line interface, allowing attackers to execute arbitrary code. This is a critical failure for DIB organizations because it represents a severe, avoidable vulnerability in network infrastructure that could lead to complete device compromise and lateral movement. Organizations must ensure all network hardware is patched and monitored for known exploited vulnerabilities.

Shame score — A fundamental command injection flaw in widely deployed network hardware that was actively exploited in the wild, demonstrating severe negligence in patching and secure design.