CVE-2016-6277

netgear d6220 firmware, netgear d6400 firmware, netgear r6250 firmware

Published 14 Dec 2016 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 7 Mar 2022, with a remediation deadline of 7 Sept 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.

References

kb.netgear.com/000036386/CVE-2016-582384 · Patch, Vendor Advisory
packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
www.securityfocus.com/bid/94819 · Broken Link, Third Party Advisory, VDB Entry
www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/ · Broken Link, Mitigation, Third Party Advisory
kalypto.org/research/netgear-vulnerability-expanded/ · Broken Link, Exploit, Third Party Advisory
www.exploit-db.com/exploits/40889/ · Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/41598/ · Exploit, Third Party Advisory, VDB Entry
www.kb.cert.org/vuls/id/582384 · Third Party Advisory, US Government Resource
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6277 · US Government Resource