CVE-2016-6277 kev in the critical feed json
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before…
published 2016-12-14 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7207
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-03-07
- epss
- 99.8%
- EPSS 99.8% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 3
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.
Patch / fix
cisa required action Apply updates per vendor instructions.
Timeline
- First public exploit (Metasploit exploit/linux/http/netgear_r7000_cgibin_exec)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-09-07 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- NETGEAR, Multiple Routers
- CISA name
- NETGEAR Multiple Routers Remote Code Execution Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
99.80% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/linux/http/netgear_r7000_cgibin_exec Netgear R7000 and R6400 cgi-bin Command Injection metasploit exploit, excellent rank, 2016-12-06
- EDB-41598 Netgear R7000 / R6400 - 'cgi-bin' Command Injection (Metasploit) remote, 2017-03-13
- EDB-40889 Netgear R7000 - Command Injection webapps, 2016-12-07
- Nuclei template NETGEAR Routers - Remote Code Execution nuclei detection template
- kalypto.org https://kalypto.org/research/netgear-vulnerability-expanded/ referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
kb.netgear.com
/000036386/CVE-2016-582384
patch, vendor-advisory
-
exploit-db.com
/exploits/40889/
exploit, third-party-advisory, vdb-entry
-
exploit-db.com
/exploits/41598/
exploit, third-party-advisory, vdb-entry
-
kalypto.org
/research/netgear-vulnerability-expanded/
broken-link, exploit, third-party-advisory
-
packetstormsecurity.com
/files/155712/Netgear-R6400-Remote-Code-Execution.html
exploit, third-party-advisory, vdb-entry
-
sj-vs.net
/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/
broken-link, mitigation, third-party-advisory
-
kb.cert.org
/vuls/id/582384
third-party-advisory, us-government-resource
-
securityfocus.com
/bid/94819
vdb-entry, broken-link, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6277
government-resource, us-government-resource
Sources
- CVE List CVE-2016-6277
- NVD CVE-2016-6277
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.