What’s Vulnerable › Vulnerabilities
CVE-2016-6277: NETGEAR Multiple Routers Remote Code Execution Vulnerability
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2022-03-07
- EPSS: 99.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2016-12-14 · updated 2026-06-17
- Weakness: CWE-352
Description
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.
Affected products
- NETGEAR D6220 Firmware: through 1.0.0.22
- Netgear D6400: through 1.0.0.56
- NETGEAR R6250 Firmware: through 1.0.4.6_10.1.12
- NETGEAR R6400 Firmware: through 1.0.1.18
- NETGEAR R6700: through 1.0.1.14
- NETGEAR R6900 Firmware: through 1.0.1.14
- NETGEAR R7000: through 1.0.7.2_1.1.93
- NETGEAR R7100Lg Firmware: through 1.0.0.28
- NETGEAR R7300Dst Firmware: through 1.0.0.46
- NETGEAR R7900 Firmware: through 1.0.1.8
- NETGEAR R8000 Firmware: through 1.0.3.26
References
- http://kb.netgear.com/000036386/CVE-2016-582384
- http://packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/94819
- http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/
- https://kalypto.org/research/netgear-vulnerability-expanded/
- https://www.exploit-db.com/exploits/40889/
- https://www.exploit-db.com/exploits/41598/
- https://www.kb.cert.org/vuls/id/582384
- http://kb.netgear.com/000036386/CVE-2016-582384
- http://packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/94819
- http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/
Get alerted when CVE-2016-6277 or the next vulnerability affects your stack