Is CVE-2016-5638 actively exploited?

No active exploitation of CVE-2016-5638 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2016-5638 be exploited remotely?

Yes. CVE-2016-5638 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2016-5638?

CVE-2016-5638 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2016-5638

HIGH

CVE-2016-5638

CWE-319Published: July 24, 2018· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genie_ping.htm or genie_ping2.htm or genie_ping3.htm page without authentication. Once accessed, the page will be redirected to the aCongratulations2.htma page, which reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text.

NVD Source

Technical Analysis

CVE-2016-5638 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.