{"id":"CVE-2016-6277","kind":"vulnerability","aliases":["CVE-2016-6277"],"related":[],"title":"NETGEAR Multiple Routers: NETGEAR Multiple Routers Remote Code Execution Vulnerability","description":"NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.","summary":"Unauthenticated command injection in the web server of 11 NETGEAR routers: shell metacharacters in the cgi-bin/ path run as root. It can be triggered by a malicious web page (CSRF) from the LAN side, or directly from the internet if remote administration is on. A public exploit exists and CISA lists it as exploited.","severity":"critical","cvss":9.3,"epss":0.99803,"exploited":true,"exploited_at":"2022-03-07T00:00:00+00:00","products":[{"name":"NETGEAR Multiple Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"NETGEAR R7000","fixed":["1.0.7.6"],"affected":"< 1.0.7.6 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R6400","fixed":["1.0.1.18"],"affected":"< 1.0.1.18 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R8000","fixed":["1.0.3.26"],"affected":"< 1.0.3.26 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R6700","fixed":["1.0.1.14"],"affected":"< 1.0.1.14 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R6250","fixed":["1.0.4.6"],"affected":"< 1.0.4.6 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R7900","fixed":["1.0.1.8"],"affected":"< 1.0.1.8 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R7100LG","fixed":["1.0.0.28"],"affected":"< 1.0.0.28 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R7300DST","fixed":["1.0.0.46"],"affected":"< 1.0.0.46 (beta fix)","ecosystem":"vendor"},{"name":"NETGEAR R6900","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"NETGEAR D6220","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"NETGEAR D6400","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","netgear","poc-public","remote-management","routers","self-hosted"],"not_affected_if":["d7000","firmware-updated","other-netgear-models","unknown"],"how_to_check":"Find your router model on the label or in the admin page. If it is R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220 or D6400, open the admin page (Advanced > Administration > Firmware Update) and compare your firmware with the latest production release on the NETGEAR support page for your model. Also check that Remote Management is off. D7000 is not affected per NETGEAR.","fix":"Install the production firmware for your model from NETGEAR support, even if you already have the beta. The NETGEAR advisory does not name production versions. NVD says these beta builds were the first fixed: R6250 1.0.4.6, R6400 1.0.1.18, R6700 1.0.1.14, R7000 1.0.7.6, R7100LG 1.0.0.28, R7300DST 1.0.0.46, R7900 1.0.1.8, R8000 1.0.3.26. Do not enable remote administration. Replace the router if it no longer gets firmware updates.","status":"resolved","published_at":"2016-12-14T16:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:23:57+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:23:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the firmware update for your NETGEAR router model per vendor instructions; the sources do not name the fixed versions.","reach":"unknown","impact":"high","summary":"Multiple NETGEAR routers pass form input from web pages straight to the device's command-line interface without authentication. An attacker can run commands on the router by getting a user to load a malicious web page or by reaching the router's web interface directly.","category":"infrastructure","who_cares":["netgear","routers","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands on the router as device administrator","analyst_note":"Find the affected NETGEAR model list and fixed firmware versions in the NETGEAR security advisory for CVE-2016-6277 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000461,"input_tokens":2843,"output_tokens":353,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected NETGEAR model list and fixed firmware versions in the NETGEAR security advisory for CVE-2016-6277 and the CISA KEV entry.","search":"'-2016':12A,15A '-6277':13A,16A '1.0.0.28.beta':127C '1.0.0.46.beta':130C '1.0.1.14.beta':120C '1.0.1.18.beta':117C '1.0.1.8.beta':133C '1.0.3.26.beta':136C '1.0.4.6.beta':114C '1.0.7.6.beta':124C '11':63B 'administr':98B 'allow':144C 'arbitrari':149C 'attack':146C 'bin':72B,161C 'cgi':71B,160C 'cgi-bin':70B,159C 'cisa':106B 'code':8A 'command':56B,150C 'csrf':86B 'cve':11A,14A 'd6220':39A,137C 'd6400':41A,138C 'd7000':139C 'direct':92B 'execut':9A,148C 'exist':104B 'exploit':42B,103B,110B 'host':54B 'info':157C 'infrastructur':43B 'inject':57B 'internet':95B 'lan':89B 'list':107B 'malici':83B 'manag':50B 'metacharact':67B,153C 'multipl':2A,5A 'multiple':18A 'netgear':1A,4A,17A,20A,22A,24A,26A,28A,30A,32A,34A,36A,38A,40A,44B,64B,111C 'page':85B 'path':73B,156C 'poc':46B 'poc-publ':45B 'possibl':141C 'public':47B,102B 'r6250':29A,112C 'r6400':23A,115C 'r6700':27A,118C 'r6900':37A,121C 'r7000':21A,122C 'r7100lg':33A,125C 'r7300dst':35A,128C 'r7900':31A,131C 'r8000':25A,134C 'remot':7A,49B,97B,145C 'remote-manag':48B 'root':76B 'router':3A,6A,51B,65B,143C 'routers':19A 'run':74B 'self':53B 'self-host':52B 'server':61B 'shell':66B,152C 'side':90B 'trigger':80B 'unauthent':55B 'via':151C 'vulner':10A 'web':60B,84B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-12-14T16:59:00+00:00","kev":{"dateAdded":"2022-03-07","dueDate":"2022-09-07","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2016-6277","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-6277","severity":null,"published_at":"2022-03-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:58+00:00","note":null},{"source":"epss","external_id":"CVE-2016-6277","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6277","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2016-6277:69","url":null,"severity":null,"published_at":"2026-10-23T21:24:49+00:00","modified_at":"2026-10-23T21:24:49+00:00","first_seen_at":"2026-10-23T21:24:49+00:00","fetched_at":"2026-10-23T21:24:49+00:00","note":"NETGEAR PSV-2016-0245 lists 11 affected models and says production firmware exists for all, but gives no version numbers. CERT/CC VU#582384 confirms the unauthenticated cgi-bin injection and a public exploit. Beta fix thresholds come from NVD; production versions not read. PoC: Exploit-DB 40889. KEV confirms exploitation."},{"source":"nvd","external_id":"CVE-2016-6277","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6277","severity":null,"published_at":"2016-12-14T16:59:00+00:00","modified_at":"2026-06-17T00:50:44+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":991,"url":"https://kb.netgear.com/000036386/CVE-2016-582384","title":"NETGEAR PSV-2016-0245 / CVE-2016-6277","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":992,"url":"https://www.kb.cert.org/vuls/id/582384","title":"CERT/CC VU#582384","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":993,"url":"https://www.exploit-db.com/exploits/40889/","title":"Exploit-DB 40889 NETGEAR cgi-bin command injection","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":994,"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6277","title":"NVD CVE-2016-6277","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}