{"schemaVersion":3,"id":"CVE-2016-6277","aliases":[],"status":"published","duplicateOf":null,"title":"NETGEAR Multiple Routers Remote Code Execution Vulnerability","description":"NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.","dates":{"published":"2016-12-14T16:00:00.000Z","modified":"2025-10-21T23:55:47.695Z","reserved":null,"kevAdded":["2022-03-07T00:00:00.000Z"],"kevDue":["2022-09-07T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99803,"percentile":0.99958,"severity":"critical","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.99803},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99803,"percentile":0.99958}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99803,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99803,"percentile":0.99958}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-07T00:00:00.000Z","dueDate":"2022-09-07T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"NETGEAR Multiple Routers Remote Code Execution Vulnerability","description":"NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-6277","label":"nvd.nist.gov/vuln/detail/CVE-2016-6277"}],"vendor":"NETGEAR","product":"Multiple Routers","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-07T00:00:00.000Z","dueDate":"2022-09-07T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"NETGEAR Multiple Routers Remote Code Execution Vulnerability","description":"NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-6277","label":"nvd.nist.gov/vuln/detail/CVE-2016-6277"}],"vendor":"NETGEAR","product":"Multiple Routers","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_B62A486AA0EA4F1B","name":"Exploit Reference (kalypto.org)","source":"reference","url":"https://kalypto.org/research/netgear-vulnerability-expanded/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_E9A51A379FC9BBA6","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"41598","name":"Netgear R7000 / R6400 - 'cgi-bin' Command Injection (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/41598","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["cgi"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"cgi","file":"exploits/cgi/remote/41598.rb","codes":["CVE-2016-6277"]},"metasploit":null},{"id":"40889","name":"Netgear R7000 - Command Injection","source":"exploit-database","url":"https://www.exploit-db.com/exploits/40889","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":null,"platforms":["cgi"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"webapps","platform":"cgi","file":"exploits/cgi/webapps/40889.txt","codes":["CVE-2016-6277"]},"metasploit":null},{"id":"MSF_EXPLOIT_LINUX_HTTP_NETGEAR_R7000_CGIBIN_EXEC","name":"Netgear R7000 and R6400 cgi-bin Command Injection","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/linux/http/netgear_r7000_cgibin_exec.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/linux/http/netgear_r7000_cgibin_exec","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":5,"weaknesses":[{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"}],"affected":[{"vendor":"netgear","product":"d6220_firmware","name":"d6220 firmware","label":"d6220_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.0.22","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.0.22","eol":null,"hubHref":"/vendor/netgear/d6220"},{"vendor":"netgear","product":"d6400_firmware","name":"d6400 firmware","label":"d6400_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.0.56","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.0.56","eol":null,"hubHref":"/vendor/netgear/d6400"},{"vendor":"netgear","product":"r6250_firmware","name":"r6250 firmware","label":"r6250_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.4.6_10.1.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.4.6_10.1.12","eol":null,"hubHref":"/vendor/netgear/r6250"},{"vendor":"netgear","product":"r6400_firmware","name":"r6400 firmware","label":"r6400_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.1.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.1.18","eol":null,"hubHref":"/vendor/netgear/r6400"},{"vendor":"netgear","product":"r6700_firmware","name":"r6700 firmware","label":"r6700_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.1.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.1.14","eol":null,"hubHref":"/vendor/netgear/r6700"},{"vendor":"netgear","product":"r6900_firmware","name":"r6900 firmware","label":"r6900_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.1.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.1.14","eol":null,"hubHref":"/vendor/netgear/r6900"},{"vendor":"netgear","product":"r7000","name":"R7000","label":"r7000","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.7.2_1.1.93","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.7.2_1.1.93","eol":null,"hubHref":"/vendor/netgear/r7000"},{"vendor":"netgear","product":"r7100lg_firmware","name":"r7100lg firmware","label":"r7100lg_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.0.28","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.0.28","eol":null,"hubHref":"/vendor/netgear/r7100lg"},{"vendor":"netgear","product":"r7300dst","name":"R7300DST","label":"r7300dst","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.0.46","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.0.46","eol":null,"hubHref":"/vendor/netgear/r7300dst"},{"vendor":"netgear","product":"r7900_firmware","name":"r7900 firmware","label":"r7900_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.1.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.1.8","eol":null,"hubHref":"/vendor/netgear/r7900"},{"vendor":"netgear","product":"r8000_firmware","name":"r8000 firmware","label":"r8000_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.3.26","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.3.26","eol":null,"hubHref":"/vendor/netgear/r8000"}],"affectedCount":11,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.exploit-db.com/exploits/40889/","label":"www.exploit-db.com/exploits/40889/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41598/","label":"www.exploit-db.com/exploits/41598/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://kb.netgear.com/000036386/CVE-2016-582384","label":"kb.netgear.com/000036386/CVE-2016-582384","hostname":"kb.netgear.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/","label":"www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/","hostname":"www.sj-vs.net","tags":["X Refsource MISC","Broken Link","Mitigation","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/582384","label":"www.kb.cert.org/vuls/id/582384","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/94819","label":"www.securityfocus.com/bid/94819","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://kalypto.org/research/netgear-vulnerability-expanded/","label":"kalypto.org/research/netgear-vulnerability-expanded/","hostname":"kalypto.org","tags":["X Refsource MISC","Broken Link","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6277","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6277","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2016-12-14T16:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-03-07T00:00:00.000Z","label":"Added to CISA KEV","detail":"NETGEAR Multiple Routers Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-09-07T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:55:47.695Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T10:00:21.814Z","stale":false,"partial":false}}