CASCACascade Atlas

Evidence dossier

CVE-2016-10174

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html.

Exploited in the wild (CISA KEV since Mar 25, 2022). NVD reports CVSS 3.1 9.8. EPSS estimates 83.3% exploit likelihood as of Oct 22, 2026.

91.2–91.9Priority evidence range
Evidence through Oct 22, 2026, 6:07 PM UTC

As of Oct 22, 2026

Normalized restatement

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

State
PUBLISHED
Published
Jan 30, 2017
Updated
Oct 21, 2025
Evidence coverage
99%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    mitre

    Record text: The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

    Inspect raw assertion
    Field
    container
    Value
    The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 83.33% probability · 99.68th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.833280000000; percentile 0.996820000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Mar 25, 2022 · first observed Sep 1, 2026

Exploit likelihood83.33%

FIRST EPSS · score date Oct 22, 2026 · 99.7th percentile · first observed Oct 22, 2026

SeverityCVSS 9.8

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusLast verified source snapshot retained

The last verified source boundary remains in force for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
Review source contract
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Oct 22, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Oct 22, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
mitreOriginal assertion
Record text

The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

Inspect raw assertion
Field
container
Value
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

83.33% probability · 99.68th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.833280000000; percentile 0.996820000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
56Underlying assertions
56Canonical products
28Target assertions
28Constraint assertions

Grouped from 56 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

57 scope groups

mitre · source assertedn/an/aDirect source scope
Affected: n/a
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "n/a"}]
NVD CPE · HARDWAREnetgeard6100Environmental constraint · 1 assertions
Version not applicableCanonical identity product-e819d986713af85c12186e708945b604f007530945d57bc7486d63c208add256Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:d6100:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7efd1e86-f100-4e46-935d-903eb6fefe9d
NVD CPE · OPERATING SYSTEMnetgeard6100_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-de68a5bb6076ac6bdaa566d12885befeca18179d6e2b05609f2208fea393b381Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:d6100_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5b7c04a4-4b5c-42d8-a6c7-8dafcc53c0ba
NVD CPE · HARDWAREnetgeard7000Environmental constraint · 1 assertions
Version not applicableCanonical identity product-4625af6b646bd3dc9d703ad49fcf4c56899d9ff99675612f88edbe31b11cb606Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:d7000:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    af04b65b-9685-4595-9c71-0f77ad7109be
NVD CPE · OPERATING SYSTEMnetgeard7000_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-ef33086914238e014b84ca85efe2484da2cd04f829069057d1b2e6681629712fLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:d7000_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    826e2415-7eb3-4f34-8c9d-87a89bb9d6d6
NVD CPE · HARDWAREnetgeard7800Environmental constraint · 1 assertions
Version not applicableCanonical identity product-ae002f05030935001e45acfa1367235e8f0be7c663e7c5ee0c52ff069de56761Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:d7800:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    2 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    da2d4987-3726-4a72-8d32-592f59fac46d
NVD CPE · OPERATING SYSTEMnetgeard7800_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-36d5efe81ee1ba742919808cfa883f9ee0f0d2319c34dfdc9f0e22f6e7e366acLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:d7800_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    92c0a12d-9eee-4dfc-8985-53d06240bbb6
NVD CPE · HARDWAREnetgearjnr1010v2Environmental constraint · 1 assertions
Version not applicableCanonical identity product-df1315d322a32a246f41dbcb7209cd38f080d91d483b0b6347b285c7961928b3Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:jnr1010v2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    3 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    91a302bb-1250-439a-947a-5727db1ce88e
NVD CPE · OPERATING SYSTEMnetgearjnr1010v2_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-631a52e95d2798441c2b37fd19de582fdfef2eea3e93e22019e2f7f78105d953Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:jnr1010v2_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b7617f12-efcc-4771-ac36-cb91e36dc7c6
NVD CPE · HARDWAREnetgearjnr3300Environmental constraint · 1 assertions
Version not applicableCanonical identity product-1b635486281053a92f6500eb2647cdd89deb4bfef5e4f9c551d908935909bc61Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:jnr3300:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    4 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    64ca12cc-48d8-4510-983c-8350a87cd5d2
NVD CPE · OPERATING SYSTEMnetgearjnr3300_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-d61e4a45c216ef7c59cd7cfc86492a18fa67c24e3eae217715fae5bff77cb388Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:jnr3300_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5865c3f2-1be0-476b-a70f-a0cb01cd71eb
NVD CPE · HARDWAREnetgearjwnr2010v5Environmental constraint · 1 assertions
Version not applicableCanonical identity product-c02e12be2f063be046cde59791b8e144de48446b800fe58341834498713a962bLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:jwnr2010v5:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    5 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3674693f-8324-4279-a402-556d5c6f31b8
NVD CPE · OPERATING SYSTEMnetgearjwnr2010v5_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-b1001cccd41cbdb893c457855c5e813dafa21277d7b86455a1d5a1a0c159a20cLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:jwnr2010v5_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    5 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    66148f9b-3495-4a62-83e7-14add4ac1f37
NVD CPE · HARDWAREnetgearr2000Environmental constraint · 1 assertions
Version not applicableCanonical identity product-d02666022ec26b89e3c73c78be9dd428a493e95d9b38910cc6f409d81cf65b4aLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:r2000:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9b1d13c3-5663-447f-9fd9-71ebec471daf
NVD CPE · OPERATING SYSTEMnetgearr2000_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-25620fc3bd791bf9bee4582615a3cb08eef08a2ad5fea38381a34339aa19b740Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:r2000_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e70db74e-a2e6-4f71-a066-282dc90db603
NVD CPE · HARDWAREnetgearr6100Environmental constraint · 1 assertions
Version not applicableCanonical identity product-112207fd19763bc7661233c6a49b8196dd398284784a4c3a84813b177ff67a57Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:r6100:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    7 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9f44a123-b256-428b-98c2-17570f2f32dc
NVD CPE · OPERATING SYSTEMnetgearr6100_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-73e259909c7501d30f65f436e3207f9db86131312c0a7f1ae90f8ed8b120083fLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:r6100_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    7 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cc498419-5d49-45d7-a941-3f7fbd4ca79d
NVD CPE · HARDWAREnetgearr6220Environmental constraint · 1 assertions
Version not applicableCanonical identity product-1c5c55e51f7871ce5d16eb274511cf67e602421f32dfc79da901fb000d10ca15Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:r6220:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    8 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b131b5c8-cb7f-433b-ba32-f05ce0e92a66
NVD CPE · OPERATING SYSTEMnetgearr6220_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-0fb158c1e51c9efab5ec742cd25cbfd78a659a7fb82a02f6665489c9bcb28451Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:r6220_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    8 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2513fc0e-56a6-4e13-9f08-015b3dd22229
NVD CPE · HARDWAREnetgearr7500Environmental constraint · 1 assertions
Version not applicableCanonical identity product-a69dc7fa877966fe6cb6273d89af3d659cfcde08153df287c6da7f807ca4621bLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:r7500:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    9 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ef3b3f26-401c-4ed0-b871-4b4f8521f369
NVD CPE · OPERATING SYSTEMnetgearr7500_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-9333bad6a859159321240bf6078c59c7d7a1db0a6dc74c70c4e7505325ca9ac0Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:r7500_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    9 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    17340c25-0b87-4ae3-b11e-b5b2367823a3
NVD CPE · HARDWAREnetgearr7500v2Environmental constraint · 1 assertions
Version not applicableCanonical identity product-34972aaedfdce79b62d2a7ff06ebe2b7e81817567502ba71f105c06457734b1fLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:r7500v2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    10 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2bca6487-57ec-4630-884f-820bbfe25843
NVD CPE · OPERATING SYSTEMnetgearr7500v2_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-b066334fd650ef5313eba78a9d138509d9e39e5344f6ef9f76ca97ab0586ed5bLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:r7500v2_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    10 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    86eb56e2-afe5-4b5a-8b08-ff76188217d7
NVD CPE · HARDWAREnetgearwndr3700v4Environmental constraint · 1 assertions
Version not applicableCanonical identity product-8bcce761a265e9faa4e75794351ba77f9d2ce99f7e175851d7d89c2e89a5efe0Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndr3700v4:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    11 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cf63301f-c798-471e-abf7-5a7e72e8588c
NVD CPE · OPERATING SYSTEMnetgearwndr3700v4_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-29f00696e769910eafc671f7d4f2aea167058b0dd4e7e4d3c3ceed4ebd0da35bLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndr3700v4_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    11 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cd0d1be2-6b68-4064-8def-ff56452e37b9

Affected-product evidence

Accepted scope and product mapping

28 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-0330ea04b2bd959040f8dea3a31c9bff0255bc05bfcba70cfcde1451bfd4dfbf

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
f0c7139c-6a9a-4d59-be84-e8cec9274b53
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-03da4e2b12424318f891c69774a71f17c99c3193e2e2eb3975bdec44d6bcaeb3

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
e1aad87f-30c9-4c00-8a94-23d6f2acdda3
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-0fb158c1e51c9efab5ec742cd25cbfd78a659a7fb82a02f6665489c9bcb28451

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
10e2bae8-e8c3-44ae-83eb-f34bc0e3391a
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-18097c14a4cf2d28fe2448824c7b81022b930a7d9bc0c43f97a7e6cc440ea30e

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
b5e1af1d-8d00-4b72-9fa5-a733c72f9638
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-25620fc3bd791bf9bee4582615a3cb08eef08a2ad5fea38381a34339aa19b740

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
a6f98de1-cf62-41e5-8b09-ac352e0b4ae3
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-29f00696e769910eafc671f7d4f2aea167058b0dd4e7e4d3c3ceed4ebd0da35b

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
974b35af-ea50-4c58-9498-4e970dbc66ae
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-2c9ec044aa99ba5ccd2913989cad8ba84fe1e8d0a153a03a6eec50e1c933ea53

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
69cfbd4d-3c44-4fe2-96f1-30b2a4e13c16
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-36d5efe81ee1ba742919808cfa883f9ee0f0d2319c34dfdc9f0e22f6e7e366ac

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
515718ea-e5d7-45b7-9369-5d2879d041ad
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-3decbdf813b1132b85fa43230c19eb6db7db870cd67a20d668d8f04fff24cb2a

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
a04491e1-0221-43a1-aabc-d25827fff701
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-44e0b3decee80d7aa1ce79bdf96037abcd07c418ea466d2988a512735dcf3708

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
7df4aeb2-1826-4995-b741-6047767f417d
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-454316c1f8bec794d82b27d61664ddabe6763957553d58110ea0c604c39a2f21

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
7b218e03-c131-4020-9098-e67fc390c223
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-631a52e95d2798441c2b37fd19de582fdfef2eea3e93e22019e2f7f78105d953

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
9d2d7177-5e1f-45b7-902d-917d1062db73
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-6a2f21b13f81667a966c0c31451ed53e3260867d5de6d47157ae1f4c26a395ed

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
990798cb-7141-4a53-a875-8a3d5c431b5e
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-73e259909c7501d30f65f436e3207f9db86131312c0a7f1ae90f8ed8b120083f

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
7f6e889f-72c6-4127-bb97-8601a90f2ad8
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-8200227f4778f16bb3392edb81f148184a9678e90fb20e0f168ef81b15340b10

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
926cf0aa-a493-4970-a4ba-8dffdf099190
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-82a818d1c679b1134d7a39096a6977070d6b8eb20359f90dd53762f82a542736

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
86069d44-f3a8-4610-994b-0cea8dab364f
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-8c729043dff9fc28b15d848447e0e3f3367f43aebfb9eca08e42a2e048afc7fc

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
e8cdf620-71a0-4dd7-8c90-2c9cf6a68091
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-91e905e5961c6fc39f4b84e7e0302bdd976786bd05bbe08f9de085cca64582c9

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
ed6361b8-fa8f-43db-b655-182345d04c74
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-9333bad6a859159321240bf6078c59c7d7a1db0a6dc74c70c4e7505325ca9ac0

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
f12e1930-c19a-4a4b-a7b5-c1dc86b87580
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-9d0bac0f3d7d09b25a584d43f09cf3904524882f89f2b2fbae3d062e96dd7d6e

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
b38971a7-8964-4356-a9f9-7afddeaf5a75
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-b066334fd650ef5313eba78a9d138509d9e39e5344f6ef9f76ca97ab0586ed5b

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
c882d26f-5760-4725-9870-ee5adafffcfb
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-b1001cccd41cbdb893c457855c5e813dafa21277d7b86455a1d5a1a0c159a20c

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
5dfd3976-881d-4491-b468-3b8de1165438
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-be65846c508285ea283cbd85c3ff0c4c875ee61e0c209c5dd338b055b10b23fb

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
bb55a1ab-9a47-425a-8254-d9fef765c206
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-c915cc60422bd274386ec1119b4a3a266ebacf5a20e7cfd79deadb8d57bf06ab

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
95e72d3d-163f-462d-a361-14c78cfe56e3
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-d61e4a45c216ef7c59cd7cfc86492a18fa67c24e3eae217715fae5bff77cb388

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
64f5a0c8-360f-430b-9ea9-74633ee6622c
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-de68a5bb6076ac6bdaa566d12885befeca18179d6e2b05609f2208fea393b381

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
08774cab-895c-45fe-8e10-8e4394ebee38
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-ef33086914238e014b84ca85efe2484da2cd04f829069057d1b2e6681629712f

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
edfb82fc-2b3e-4e46-a2b7-6045acf6a42d
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-f38993c6aa1172ab8c7798da135a7389435fb39c8e9cbfde65555b9b8f74f416

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
f1c22a30-0f24-466e-892a-8658561d6132
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
af566d3a-d7f2-48c2-85ec-b5937629a296

Assessments

CVSS by origin

9.8
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10.0
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:N/C:C/I:C/A:C
9.8
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

9.8Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
9.8
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.