Log in Start free

Actively exploited · Published Dec 14, 2016 · Assigned by mitre

CVE-2016-6277

High 8.8 Exploited

In plain English

A high-severity cross-site request forgery in Multiple Routers from NETGEAR. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2022). The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)99.8%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Mar 7, 2022
Attack tooling2Metasploit, Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 7, 2022.

Official description

NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References