# CVE-2016-6277: NETGEAR Multiple Routers Remote Code Execution Vulnerability

Source: https://junglewise.ai/threats/cve-2016-6277-netgear-multiple-routers-remote-code-execution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-07. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2016-6277 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-03-07

Multiple NETGEAR routers are vulnerable to remote code execution due to improper sanitization of shell metacharacters in the path info to cgi-bin. An unauthenticated attacker can execute arbitrary commands by passing malicious input through web pages to the command-line interface.

Technologies: [TP-Link Multiple Routers](https://junglewise.ai/threats/technologies/multiple-routers). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2016-6277 exploited in the wild?** Yes. CVE-2016-6277 is known to be exploited in the wild, first recorded on 7 March 2022. Treat it as urgent.

**How severe is CVE-2016-6277?** Critical severity, with a CVSS score of 8.8, published 7 March 2022.

**Which products and versions are affected?** NETGEAR R6250 before 1.0.4.6.Beta; NETGEAR R6400 before 1.0.1.18.Beta; NETGEAR R6700 before 1.0.1.14.Beta; NETGEAR R6900 all; and 8 more.

**Is there a fix for CVE-2016-6277?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-6277 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-6277?** Check whether you run TP-Link Multiple Routers. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- NETGEAR R6250 before 1.0.4.6.Beta
- NETGEAR R6400 before 1.0.1.18.Beta
- NETGEAR R6700 before 1.0.1.14.Beta
- NETGEAR R6900 all
- NETGEAR R7000 before 1.0.7.6.Beta
- NETGEAR R7100LG before 1.0.0.28.Beta
- NETGEAR R7300DST before 1.0.0.46.Beta
- NETGEAR R7900 before 1.0.1.8.Beta
- NETGEAR R8000 before 1.0.3.26.Beta
- NETGEAR D6220 all
- NETGEAR D6400 all
- NETGEAR D7000 all

## Timeline

- 2016-12-09: disclosed: Initial vulnerability disclosure (based on BID 94819 date)
- 2022-03-07: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

## Related threats

- [TP-Link Archer C7 and TL-WR841N OS command injection in Parental Control](https://junglewise.ai/threats/cve-2025-9377-tp-link-archer-c7-and-tl-wr841n-os-command-injection-in-parental)
- [TP-Link Multiple Routers command injection in WlanNetworkRpm](https://junglewise.ai/threats/cve-2023-33538-tp-link-multiple-routers-command-injection-in-wlannetworkrpm)
- [D-Link Multiple Routers OS Command Injection Vulnerability](https://junglewise.ai/threats/cve-2018-6530-d-link-multiple-routers-os-command-injection-vulnerability)
- [D-Link Multiple Routers Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2021-45382-d-link-multiple-routers-remote-code-execution-vulnerability)
- [D-Link Multiple Routers Command Injection Vulnerability](https://junglewise.ai/threats/cve-2019-16920-d-link-multiple-routers-command-injection-vulnerability)