--- id: "CVE-2016-6277" kind: "vulnerability" aliases: ["CVE-2016-6277"] title: "NETGEAR Multiple Routers: NETGEAR Multiple Routers Remote Code Execution Vulnerability" severity: "critical" cvss: 9.3 epss: 0.99803 exploited: true status: "resolved" category: "infrastructure" products: [{"name": "NETGEAR Multiple Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "NETGEAR R7000", "fixed": ["1.0.7.6"], "affected": "< 1.0.7.6 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R6400", "fixed": ["1.0.1.18"], "affected": "< 1.0.1.18 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R8000", "fixed": ["1.0.3.26"], "affected": "< 1.0.3.26 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R6700", "fixed": ["1.0.1.14"], "affected": "< 1.0.1.14 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R6250", "fixed": ["1.0.4.6"], "affected": "< 1.0.4.6 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R7900", "fixed": ["1.0.1.8"], "affected": "< 1.0.1.8 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R7100LG", "fixed": ["1.0.0.28"], "affected": "< 1.0.0.28 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R7300DST", "fixed": ["1.0.0.46"], "affected": "< 1.0.0.46 (beta fix)", "ecosystem": "vendor"}, {"name": "NETGEAR R6900", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "NETGEAR D6220", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "NETGEAR D6400", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "netgear", "poc-public", "remote-management", "routers", "self-hosted"] not_affected_if: ["d7000", "firmware-updated", "other-netgear-models", "unknown"] published_at: "2016-12-14T16:59:00+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T21:57:35+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-6277", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-6277", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:24:49+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6277", "first_seen_at": "2026-10-23T21:57:35+00:00"}] --- # NETGEAR Multiple Routers: NETGEAR Multiple Routers Remote Code Execution Vulnerability Unauthenticated command injection in the web server of 11 NETGEAR routers: shell metacharacters in the cgi-bin/ path run as root. It can be triggered by a malicious web page (CSRF) from the LAN side, or directly from the internet if remote administration is on. A public exploit exists and CISA lists it as exploited. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:NETGEAR Multiple Routers affected ? fixed ? - vendor:NETGEAR R7000 affected < 1.0.7.6 (beta fix) fixed 1.0.7.6 - vendor:NETGEAR R6400 affected < 1.0.1.18 (beta fix) fixed 1.0.1.18 - vendor:NETGEAR R8000 affected < 1.0.3.26 (beta fix) fixed 1.0.3.26 - vendor:NETGEAR R6700 affected < 1.0.1.14 (beta fix) fixed 1.0.1.14 - vendor:NETGEAR R6250 affected < 1.0.4.6 (beta fix) fixed 1.0.4.6 - vendor:NETGEAR R7900 affected < 1.0.1.8 (beta fix) fixed 1.0.1.8 - vendor:NETGEAR R7100LG affected < 1.0.0.28 (beta fix) fixed 1.0.0.28 - vendor:NETGEAR R7300DST affected < 1.0.0.46 (beta fix) fixed 1.0.0.46 - vendor:NETGEAR R6900 affected unknown fixed ? - vendor:NETGEAR D6220 affected unknown fixed ? - vendor:NETGEAR D6400 affected unknown fixed ? ## How to check Find your router model on the label or in the admin page. If it is R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220 or D6400, open the admin page (Advanced > Administration > Firmware Update) and compare your firmware with the latest production release on the NETGEAR support page for your model. Also check that Remote Management is off. D7000 is not affected per NETGEAR. ## Fix Install the production firmware for your model from NETGEAR support, even if you already have the beta. The NETGEAR advisory does not name production versions. NVD says these beta builds were the first fixed: R6250 1.0.4.6, R6400 1.0.1.18, R6700 1.0.1.14, R7000 1.0.7.6, R7100LG 1.0.0.28, R7300DST 1.0.0.46, R7900 1.0.1.8, R8000 1.0.3.26. Do not enable remote administration. Replace the router if it no longer gets firmware updates. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-6277 - 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-6277 - 2026-10-23T21:24:49+00:00 analyst — NETGEAR PSV-2016-0245 lists 11 affected models and says production firmware exists for all, but gives no version numbers. CERT/CC VU#582384 confirms the unauthenticated cgi-bin injection and a public exploit. Beta fix thresholds come from NVD; production versions not read. PoC: Exploit-DB 40889. KEV confirms exploitation. - 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-6277 ## Documents - [advisory] NETGEAR PSV-2016-0245 / CVE-2016-6277 https://kb.netgear.com/000036386/CVE-2016-582384 - [describes] CERT/CC VU#582384 https://www.kb.cert.org/vuls/id/582384 - [describes] NVD CVE-2016-6277 https://nvd.nist.gov/vuln/detail/CVE-2016-6277 - [poc] Exploit-DB 40889 NETGEAR cgi-bin command injection https://www.exploit-db.com/exploits/40889/ ## From the sources NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_