CVE-2016-6277
NETGEAR Multiple Routers Remote Code Execution Vulnerability
Description
CVE-2016-6277 is a high-severity cross-site request forgery (csrf) vulnerability affecting NETGEAR Multiple Routers. NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.99% (99.9th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netgear | d6220 firmware | <= 1.0.0.22 |
| netgear | d6400 firmware | <= 1.0.0.56 |
| netgear | r6250 firmware | <= 1.0.4.6_10.1.12 |
| netgear | r6400 firmware | <= 1.0.1.18 |
| netgear | r6700 firmware | <= 1.0.1.14 |
| netgear | r6900 firmware | <= 1.0.1.14 |
| netgear | r7000 firmware | <= 1.0.7.2_1.1.93 |
| netgear | r7100lg firmware | <= 1.0.0.28 |
| netgear | r7300dst firmware | <= 1.0.0.46 |
| netgear | r7900 firmware | <= 1.0.1.8 |
| netgear | r8000 firmware | <= 1.0.3.26 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://kb.netgear.com/000036386/CVE-2016-582384(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/94819(Broken Link, Third Party Advisory, VDB Entry)
- http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/(Broken Link, Mitigation, Third Party Advisory)
- https://kalypto.org/research/netgear-vulnerability-expanded/(Broken Link, Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/40889/(Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41598/(Exploit, Third Party Advisory, VDB Entry)
- https://www.kb.cert.org/vuls/id/582384(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6277(US Government Resource)
Weakness Type
CWE-352: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) is a vulnerability that occurs when a web application does not sufficiently verify whether a request came from an authorized user or was forged by an attacker. CSRF attacks trick authenticated users into executing unintended actions by exploiting the trust a web application has in the user's browser.
Learn more: CWE-352 — Cross-Site Request Forgery (CSRF)
Impact Analysis
CVE-2016-6277 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a high-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation can severely compromise data confidentiality, and allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected Multiple Routers deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2016-6277 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 93.99% (99.9th percentile) reflects an exceptionally high probability of exploitation. Public exploit code is available, which lowers the barrier for attackers and increases the urgency of remediation. Federal agencies were required to remediate this vulnerability by 2022-09-07 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (netgear d6220 firmware <= 1.0.0.22; netgear d6400 firmware <= 1.0.0.56; netgear r6250 firmware <= 1.0.4.6_10.1.12) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2016-6277 affects NETGEAR Multiple Routers. NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 8.8 reflects a serious vulnerability that poses meaningful risk to affected environments.
Frequently Asked Questions
Is CVE-2016-6277 being actively exploited?
Yes. CVE-2016-6277 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 93.99% (99.9th percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2016-6277?
CVE-2016-6277 affects NETGEAR Multiple Routers. Specifically affected products include: netgear d6220 firmware (<= 1.0.0.22), netgear d6400 firmware (<= 1.0.0.56), netgear r6250 firmware (<= 1.0.4.6_10.1.12), netgear r6400 firmware (<= 1.0.1.18), netgear r6700 firmware (<= 1.0.1.14).
How do I fix CVE-2016-6277?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2016-6277?
CVE-2016-6277 has a CVSS 3.1 score of 8.8 (HIGH). This is a high-severity vulnerability that should be prioritized for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.