⚠ Actively exploited
Added to CISA KEV on 2022-03-07. Federal agencies required to patch by 2022-09-07. Required action: Apply updates per vendor instructions..

CVE-2016-6277 — Cross-Site Request Forgery in Netgear D6220 Firmware

CWE-352 — Cross-Site Request Forgery9 documents7 sources
Severity
8.8HIGHNVD
EPSS
94.3%
top 0.06%
CISA KEV
KEV
Added 2022-03-07
Due 2022-09-07
Exploit
Exploited in wild
Active exploitation observed
Affected products
11
Netgear D6220 FirmwareNetgear D6400 FirmwareNetgear R6250 Firmware+8 more
Timeline
PublishedDec 14
KEV addedMar 7
Latest updateMay 17
KEV dueSep 7
CISA Required Action: Apply updates per vendor instructions.

Description

NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages11 packages

▶NVDnetgear/r6250_firmware1.0.4.6_10.1.12

Patches

Patch: kb.netgear.com ↗Patch: kb.netgear.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-pxpc-qfm6-wwp4: NETGEAR R6250 before 1↗2022-05-17
▶
CVEList
CVE-2016-6277: NETGEAR R6250 before 1↗2016-12-14
▶
VulnCheck
NETGEAR Multiple Routers Remote Code Execution Vulnerability↗2016
▶

💥Exploits & PoCs

4
Exploit-DB
Netgear R6400 - Remote Code Execution↗2019-12-17
▶
Exploit-DB
Netgear R7000 / R6400 - 'cgi-bin' Command Injection (Metasploit)↗2017-03-13
▶
Exploit-DB
Netgear R7000 - Command Injection↗2016-12-07
▶
Nuclei
NETGEAR Routers - Remote Code Execution
▶

📋Vendor Advisories

1
CISA
NETGEAR Multiple Routers Remote Code Execution Vulnerability↗2022-03-07
▶
CVE-2016-6277 — Cross-Site Request Forgery in Netgear | cvebase