Netgear WN604 - RCE (CVE-2016-1555)

CVE-2016-1555 is a critical vulnerability affecting certain Netgear devices, allowing remote attackers to execute arbitrary commands by exploiting weaknesses in how sensitive PHP endpoints handle user input.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

CrowdSec network data shows that most actors exploiting CVE-2016-1555 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2016-1555. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Exploitation attempts typically involve requests to URLs containing /boarddataww.php.