CVE-2016-6277 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-03-07
Multiple NETGEAR routers are vulnerable to remote code execution due to improper sanitization of shell metacharacters in the path info to cgi-bin. An unauthenticated attacker can execute arbitrary commands by passing malicious input through web pages to the command-line interface.
Yes. CVE-2016-6277 is known to be exploited in the wild, first recorded on 7 March 2022. Treat it as urgent.
How severe is CVE-2016-6277?
Critical severity, with a CVSS score of 8.8, published 7 March 2022.
Which products and versions are affected?
NETGEAR R6250 before 1.0.4.6.Beta; NETGEAR R6400 before 1.0.1.18.Beta; NETGEAR R6700 before 1.0.1.14.Beta; NETGEAR R6900 all; and 8 more.
Is there a fix for CVE-2016-6277?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-6277 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-6277?
Check whether you run TP-Link Multiple Routers. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
NETGEAR R6250 before 1.0.4.6.Beta
NETGEAR R6400 before 1.0.1.18.Beta
NETGEAR R6700 before 1.0.1.14.Beta
NETGEAR R6900 all
NETGEAR R7000 before 1.0.7.6.Beta
NETGEAR R7100LG before 1.0.0.28.Beta
NETGEAR R7300DST before 1.0.0.46.Beta
NETGEAR R7900 before 1.0.1.8.Beta
NETGEAR R8000 before 1.0.3.26.Beta
NETGEAR D6220 all
NETGEAR D6400 all
NETGEAR D7000 all
Timeline
2016-12-09: disclosed: Initial vulnerability disclosure (based on BID 94819 date)
2022-03-07: kev added: Added to CISA Known Exploited Vulnerabilities Catalog