CVE-2016-6277 NETGEAR Multiple Routers Remote Code Execution
Remote attackers can execute arbitrary commands on NETGEAR routers via shell metacharacters in the path info to cgi-bin.
- Exploited in the wild
- Since 7 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2016-6277?
CVE-2016-6277 is a high-severity command injection vulnerability in Netgear D6220 Firmware, published on 14 Dec 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.
Weakness: CWE-352
Which versions are affected by CVE-2016-6277?
It affects 11 products.
Products include Netgear D6220 Firmware, Netgear D6400 Firmware, Netgear R6250 Firmware, Netgear R6400 Firmware, Netgear R6700 Firmware, Netgear R6900 Firmware and 5 more.
How do I fix CVE-2016-6277?
No fix has been published for CVE-2016-6277 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 7 Sep 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-6277 being exploited?
Yes. Attackers have exploited CVE-2016-6277 in the wild since at least 7 Mar 2022.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries and 1 Nuclei template.
Other vulnerabilities in Netgear D6220 Firmware
Sources
Also known as GHSA-pxpc-qfm6-wwp4.