How do I check whether I am affected by CVE-2016-6277?

Find your router model on the label or in the admin page. If it is R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220 or D6400, open the admin page (Advanced > Administration > Firmware Update) and compare your firmware with the latest production release on the NETGEAR support page for your model. Also check that Remote Management is off. D7000 is not affected per NETGEAR.

What is the fix for CVE-2016-6277?

Install the production firmware for your model from NETGEAR support, even if you already have the beta. The NETGEAR advisory does not name production versions. NVD says these beta builds were the first fixed: R6250 1.0.4.6, R6400 1.0.1.18, R6700 1.0.1.14, R7000 1.0.7.6, R7100LG 1.0.0.28, R7300DST 1.0.0.46, R7900 1.0.1.8, R8000 1.0.3.26. Do not enable remote administration. Replace the router if it no longer gets firmware updates.

Who is not affected by CVE-2016-6277?

Not affected if: d7000, firmware-updated, other-netgear-models, unknown.

Live › vulnerability › CVE-2016-6277

Go to dashboard

critical9.3Exploited in the wildPoC publicInfrastructureresolved

NETGEAR Multiple Routers: NETGEAR Multiple Routers Remote Code Execution Vulnerability

Unauthenticated command injection in the web server of 11 NETGEAR routers: shell metacharacters in the cgi-bin/ path run as root. It can be triggered by a malicious web page (CSRF) from the LAN side, or directly from the internet if remote administration is on. A public exploit exists and CISA lists it as exploited.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far6 of 6

First public: Dec 14, 2016 UTC
Last modified: Oct 23, 2026
Status: resolved
Known exploitation: Listed in CISA KEV
Public exploit: 1 PoC repo on GitHub
EPSS: 99.8% in 30d

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 7, 2022 and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker runs arbitrary commands on the router as device administrator.
CVSS said: 9.3. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2016-6277

Go to dashboard

critical9.3Exploited in the wildPoC publicInfrastructureresolved

NETGEAR Multiple Routers: NETGEAR Multiple Routers Remote Code Execution Vulnerability

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far6 of 6

First public: Dec 14, 2016 UTC
Last modified: Oct 23, 2026
Status: resolved
Known exploitation: Listed in CISA KEV
Public exploit: 1 PoC repo on GitHub
EPSS: 99.8% in 30d

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 7, 2022 and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker runs arbitrary commands on the router as device administrator.
CVSS said: 9.3. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
NETGEAR Multiple Routers	vendor	–	–
NETGEAR R7000	vendor	< 1.0.7.6 (beta fix)	1.0.7.6
NETGEAR R6400	vendor	< 1.0.1.18 (beta fix)	1.0.1.18
NETGEAR R8000	vendor	< 1.0.3.26 (beta fix)	1.0.3.26
NETGEAR R6700	vendor	< 1.0.1.14 (beta fix)	1.0.1.14
NETGEAR R6250	vendor	< 1.0.4.6 (beta fix)	1.0.4.6
NETGEAR R7900	vendor	< 1.0.1.8 (beta fix)	1.0.1.8
NETGEAR R7100LG	vendor	< 1.0.0.28 (beta fix)	1.0.0.28
NETGEAR R7300DST	vendor	< 1.0.0.46 (beta fix)	1.0.0.46
NETGEAR R6900	vendor	unknown	–
NETGEAR D6220	vendor	unknown	–
NETGEAR D6400	vendor	unknown	–

NETGEAR Multiple Routers: NETGEAR Multiple Routers Remote Code Execution Vulnerability

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

NETGEAR Multiple Routers: NETGEAR Multiple Routers Remote Code Execution Vulnerability

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources