CVE-2016-6277

KEVNETGEAR Multiple Routers Remote Code Execution Vulnerability

Description

NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.

NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedDec 14, 2016

Last modifiedJun 17, 2026

Added to KEVMar 7, 2022

Remediation dueSep 7, 2022

References

kb.netgear.com/000036386/CVE-2016-582384PatchVendor Advisory
packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.htmlExploitThird Party Advisory
securityfocus.com/bid/94819Broken LinkThird Party Advisory
sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/Broken LinkMitigation
kalypto.org/research/netgear-vulnerability-expanded/Broken LinkExploit
exploit-db.com/exploits/40889/Third Party AdvisoryVDB Entry
exploit-db.com/exploits/41598/ExploitThird Party Advisory
kb.cert.org/vuls/id/582384Third Party AdvisoryUS Government Resource
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6277US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1511 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 99.8% · top 1% of all CVEs
Weakness: CWE-352
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.