60
CVE-2016-6277
KEV PoC ×3massUnauthenticated RCE via Command Injection in NETGEAR Multiple Routers
CISA: NETGEAR Multiple Routers Remote Code Execution Vulnerability
CVSS 3.1
8.8 high
EPSS
100%p100
Published
()
KEV added
AI analysis
Multiple NETGEAR router models allow unauthenticated web pages to pass form input directly to the device's command-line interface, which permits remote code execution (CVE-2016-6277). An attacker triggers the flaw by sending a crafted HTTP request to the router's web interface without logging in, causing attacker-supplied input to be interpreted as commands on the router. Successful exploitation grants the ability to run arbitrary commands on the device, typically with root privileges, enabling full takeover of the router and use as a pivot point into the network behind it. Any NETGEAR router among the affected models running firmware without the vendor patch is vulnerable, with internet-facing management interfaces at greatest risk. The flaw was added to CISA's Known Exploited Vulnerability catalog on 2022-03-07, indicating exploitation in the wild, and it carries a very high 99.8% EPSS probability of exploitation within 30 days.
What to do: Update affected NETGEAR routers to the latest available firmware for the specific model, per the vendor's upgrade instructions, as required by CISA's KEV listing. As interim mitigation, disable WAN-side/remote management and restrict the router's admin interface to the local network, then review devices for signs of compromise such as unexpected configuration changes or added accounts.
Affected
| NETGEAR | — |
Estimated exposure
masslikely 100,000+ internet-exposed NETGEAR routers (exact count unknown) — Public internet-wide scans have historically found hundreds of thousands of NETGEAR routers exposing their web administration interface, and NETGEAR's consumer router installed base is in the millions, making a mass-scale estimate…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.
CISA Known Exploited Vulnerability
- Affected
- NETGEAR Multiple Routers
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Unknown
- Vendors
- netgear
- Products
- d6220 firmware, d6400 firmware, r6250 firmware, r6400 firmware, r6700 firmware, r6900 firmware, r7000 firmware, r7100lg firmware, r7300dst firmware, r7900 firmware, r8000 firmware
- Weakness
- CWE-352
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news8 stories
60
CISA urges to fix actively exploited Firefox zero
60
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
Fortinet FortiGuard Labs identified Evooo1Bot, a previously undocumented Linux botnet built on the leaked Mirai source code, active in the wild since July 2026 and targeting internet-facing edge devices. It exploits numerous known CVEs in routers and devices from D-Link, Tenda, Telesquare, Zyxel, Hikvision, Atlassian Confluence, WSO2, TP-Link, NETGEAR, and others, delivering a bot binary via a wget.sh loader from 91.92.40.118 that clears bash history. The bot offers encrypted C2 on port 443, SSH brute-force scanning, credential sniffing, DDoS over DNS/TCP/UDP, an HTTP exploit dispatcher, and converts infected hosts into SOCKS5 proxies for anonymizing follow-on operations.
55
47
47
New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
Fortinet's FortiGuard Labs disclosed Evooo1Bot, a previously undocumented Linux botnet active since July 2026 that reuses Mirai's DDoS engine while adding encrypted C2, SSH brute-force scanning, credential sniffing, and SOCKS5 proxy modules. The bot exploits 18 known CVEs across Alcatel, NETGEAR, Tenda, D-Link, Telesquare, and Mitsubishi devices, some dating back to 2007, and communicates exclusively over port 443 to blend with HTTPS traffic. Compromised hosts can be turned into SOCKS5 relays for anonymous traffic forwarding or monetization via proxy services. The malware uses AES-256-CTR, ChaCha20, and XOR obfuscation with a 28-command administration interface.
45
35