CASCACascade Atlas

Evidence dossier

CVE-2016-1555

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320,…

Exploited in the wild (CISA KEV since Mar 25, 2022). NVD reports CVSS 3.1 9.8. EPSS estimates 98.3% exploit likelihood as of Oct 22, 2026.

90.0–90.9Priority evidence range
Evidence through Oct 22, 2026, 6:07 PM UTC

As of Oct 22, 2026

Normalized restatement

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

State
PUBLISHED
Published
Apr 21, 2017
Updated
Oct 21, 2025
Evidence coverage
98%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    certcc

    Record text: (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

    Inspect raw assertion
    Field
    container
    Value
    (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: NETGEAR Multiple WAP Devices Command Injection Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    NETGEAR Multiple WAP Devices Command Injection Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 98.29% probability · 99.92th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.982880000000; percentile 0.999180000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Mar 25, 2022 · first observed Sep 1, 2026

Exploit likelihood98.29%

FIRST EPSS · score date Oct 22, 2026 · 99.9th percentile · first observed Oct 22, 2026

SeverityCVSS 9.8

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusLast verified source snapshot retained

The last verified source boundary remains in force for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
Review source contract
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Oct 22, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Oct 22, 2026
Resolution
Resolve identity

Source comparison

Who said what

certccOriginal assertion
Record text

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

Inspect raw assertion
Field
container
Value
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

NETGEAR Multiple WAP Devices Command Injection Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
NETGEAR Multiple WAP Devices Command Injection Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

98.29% probability · 99.92th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.982880000000; percentile 0.999180000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
14Underlying assertions
14Canonical products
7Target assertions
7Constraint assertions

Grouped from 14 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

15 scope groups

certcc · source assertedn/an/aDirect source scope
Affected: n/a
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "n/a"}]
NVD CPE · HARDWAREnetgearwn604Environmental constraint · 1 assertions
Version not applicableCanonical identity product-1780981622bd1910eafa81b5f138916c4eed4565ac6283ba7f377dcae31aeedbLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wn604:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    4 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cd31dcaa-baa5-4463-9ea4-a7076a625407
NVD CPE · OPERATING SYSTEMnetgearwn604_firmwareVulnerable target · 1 assertions
Any version (unconstrained) (<= 3.3.2)Canonical identity product-01541bdf1b65a5aeb7e346c9bf046a11003e05d1dfff5b7e80ef32cf47563240Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wn604_firmware:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 0
    Logic
    OR
    Version bounds
    through including 3.3.2
    Match ID
    8ca9cfc3-d7d5-4538-aa31-9c4504e5afa7
NVD CPE · HARDWAREnetgearwn802tv2Environmental constraint · 1 assertions
Version not applicableCanonical identity product-f5bcf6c06c74d269301c5e9444388a9204dad7be0928d97e2ec8fb705e9cbc98Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wn802tv2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    05b05670-cc01-4f53-b1a7-83fe3afba12e
NVD CPE · OPERATING SYSTEMnetgearwn802tv2_firmwareVulnerable target · 1 assertions
Any version (unconstrained) (<= 3.0.5.0)Canonical identity product-200172c4db86f8fbee4d4bd4d61f46969f0a67ead19a6c09225ce6065439105aLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wn802tv2_firmware:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 0
    Logic
    OR
    Version bounds
    through including 3.0.5.0
    Match ID
    169f7661-bb39-4188-a26e-9791fce1da6b
NVD CPE · HARDWAREnetgearwnap320Environmental constraint · 1 assertions
Version not applicableCanonical identity product-04d90a6360cc087f00636b4e2fac753e960b117cd9c3d06c7494461994ea9722Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wnap320:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5e2613e9-caf9-4c04-85bc-e10bdf4b0e74
NVD CPE · OPERATING SYSTEMnetgearwnap320_firmwareVulnerable target · 1 assertions
Any version (unconstrained) (<= 3.0.5.0)Canonical identity product-ec07f18a8dea4c0866a9c1bb6a7fa226ef82d549b462222479af1ee84441a4a6Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wnap320_firmware:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    through including 3.0.5.0
    Match ID
    cbce4d2f-5a11-4043-8f3e-4c10d155a6ed
NVD CPE · HARDWAREnetgearwndap210v2Environmental constraint · 1 assertions
Version not applicableCanonical identity product-273da0bd6682257ba5b4c0e0f928b549c8b11c1eb9538f9daf75089ac1d82862Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndap210v2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    3 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5d1ad5a1-5212-4c0a-88bb-f34314f9c037
NVD CPE · OPERATING SYSTEMnetgearwndap210v2_firmwareVulnerable target · 1 assertions
Any version (unconstrained) (<= 3.0.5.0)Canonical identity product-87092b67260f991392701d7fa7e02d4864b4f1ddc6d872fd1d67c18532860635Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndap210v2_firmware:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 0
    Logic
    OR
    Version bounds
    through including 3.0.5.0
    Match ID
    9801e95c-9464-4594-b4e8-6f227c597c27
NVD CPE · HARDWAREnetgearwndap350Environmental constraint · 1 assertions
Version not applicableCanonical identity product-d539a65f1861f15a9b8cf2ebc2ce1650fd84b4f47129b89598ae5b10512eaf46Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndap350:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c82a16c2-dc48-4792-a4c7-8ac43f84196d
NVD CPE · OPERATING SYSTEMnetgearwndap350_firmwareVulnerable target · 1 assertions
Any version (unconstrained) (<= 3.0.5.0)Canonical identity product-79d835119e429b503ca1b3bd7559c83b0a44839a407a8c64b6a76e69bac7cfb9Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndap350_firmware:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 0
    Logic
    OR
    Version bounds
    through including 3.0.5.0
    Match ID
    cb422d25-d72d-445b-869d-4a5fbf285357
NVD CPE · HARDWAREnetgearwndap360Environmental constraint · 1 assertions
Version not applicableCanonical identity product-a57901335748a0666b8084d869d9dd8b1c3ce70644f8e336dfd7c4b0067ed736Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndap360:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    2 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7975d6ec-1816-4d52-8c87-77c1b6404120
NVD CPE · OPERATING SYSTEMnetgearwndap360_firmwareVulnerable target · 1 assertions
Any version (unconstrained) (<= 3.0.5.0)Canonical identity product-756749d336f7d5e4da0946cda8148f0c5635485b69e0ea2a7931d45cdb7933dfLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndap360_firmware:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 0
    Logic
    OR
    Version bounds
    through including 3.0.5.0
    Match ID
    fa1e8f1e-ab78-4c4b-be0b-ae17e4636077
NVD CPE · HARDWAREnetgearwndap660Environmental constraint · 1 assertions
Version not applicableCanonical identity product-8d4b687fc5968567f112b64bd7534a2ec8e1ef957f9c2d4a24dd31d85cbd55ddLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndap660:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    5 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    58d2492e-0cdc-4242-9206-7f0453b11cbd
NVD CPE · OPERATING SYSTEMnetgearwndap660_firmwareVulnerable target · 1 assertions
Any version (unconstrained) (<= 3.0.5.0)Canonical identity product-925e19a92ab6d361ca52b79c01c96e7fff7868a1cebb9a842d3bb78110169ca7Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndap660_firmware:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    5 · node/0 · match 0
    Logic
    OR
    Version bounds
    through including 3.0.5.0
    Match ID
    99e67c3d-8907-4a96-bbaa-128959db3962

Affected-product evidence

Accepted scope and product mapping

7 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-01541bdf1b65a5aeb7e346c9bf046a11003e05d1dfff5b7e80ef32cf47563240

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
96bc5025-8a5e-40d4-ad00-f68614bc0fd3
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-200172c4db86f8fbee4d4bd4d61f46969f0a67ead19a6c09225ce6065439105a

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
f741dd75-9ba7-437e-871c-8a206e3ac6fc
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-756749d336f7d5e4da0946cda8148f0c5635485b69e0ea2a7931d45cdb7933df

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
0ba87c4d-4bdb-4729-a878-68ce4f95e2d4
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-79d835119e429b503ca1b3bd7559c83b0a44839a407a8c64b6a76e69bac7cfb9

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
b1370c02-2dca-40a1-a26e-de49fc35978c
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-87092b67260f991392701d7fa7e02d4864b4f1ddc6d872fd1d67c18532860635

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
7265435c-ee61-4ac6-b07d-3357327f137f
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-925e19a92ab6d361ca52b79c01c96e7fff7868a1cebb9a842d3bb78110169ca7

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
6a8b2c9b-273c-4118-94c4-424a8ff33b54
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-ec07f18a8dea4c0866a9c1bb6a7fa226ef82d549b462222479af1ee84441a4a6

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
0e6411d3-e29f-4cfe-b057-9c4c67ad46d5
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
16c25fe6-c282-48eb-8ece-00e1a09401b1

Assessments

CVSS by origin

9.8
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10.0
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:N/C:C/I:C/A:C
9.8
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

9.8Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
9.8
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.