PT-2016-3443 · NetGear · Netgear R6250+9

Chad Dougherty · Published 2016-12-14 · Updated 2025-01-22 · CVE-2016-6277

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR R6250 versions 1.0.4.6.Beta and earlier NETGEAR R6400 versions 1.0.1.18.Beta and earlier NETGEAR R6700 versions 1.0.1.14.Beta and earlier NETGEAR R6900 (affected versions not specified) NETGEAR R7000 versions 1.0.7.6.Beta and earlier NETGEAR R7100LG versions 1.0.0.28.Beta and earlier NETGEAR R7300DST versions 1.0.0.46.Beta and earlier NETGEAR R7900 versions 1.0.1.8.Beta and earlier NETGEAR R8000 versions 1.0.3.26.Beta and earlier NETGEAR D6220 (affected versions not specified) NETGEAR D6400 (affected versions not specified) NETGEAR D7000 (affected versions not specified)

Description The issue is related to insufficient authentication of executed requests, allowing remote attackers to execute arbitrary commands via shell metacharacters in the path info to "cgi-bin/". This can be exploited by sending malicious requests to the vulnerable routers.

Recommendations For NETGEAR R6250 version 1.0.4.6.Beta and earlier, update to version 1.0.4.6.Beta or later. For NETGEAR R6400 version 1.0.1.18.Beta and earlier, update to version 1.0.1.18.Beta or later. For NETGEAR R6700 version 1.0.1.14.Beta and earlier, update to version 1.0.1.14.Beta or later. For NETGEAR R6900, NETGEAR D6220, NETGEAR D6400, and NETGEAR D7000, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For NETGEAR R7000 version 1.0.7.6.Beta and earlier, update to version 1.0.7.6.Beta or later. For NETGEAR R7100LG version 1.0.0.28.Beta and earlier, update to version 1.0.0.28.Beta or later. For NETGEAR R7300DST version 1.0.0.46.Beta and earlier, update to version 1.0.0.46.Beta or later. For NETGEAR R7900 version 1.0.1.8.Beta and earlier, update to version 1.0.1.8.Beta or later. For NETGEAR R8000 version 1.0.3.26.Beta and earlier, update to version 1.0.3.26.Beta or later. As a temporary workaround, consider restricting access to the "cgi-bin/" endpoint until a patch is available.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2023-01043

CVE-2016-6277

Affected Products

Netgear R6220

Netgear R6400

Netgear R7000

Netgear R6250

Netgear R6700

Netgear R6900P

Netgear R7100Lg

Netgear R7300Dst

Netgear R7900

Netgear R8000

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_r7000_cgibin_exec.rb · Exploit
• 🔥 https://github.com/nixawk/labs/tree/master/CVE-2016-6277 · Exploit
• 🔥 https://exploit-db.com/exploits/40889 · Exploit
• 🔥 https://exploit-db.com/exploits/41598 · Exploit
• 🔥 http://packetstormsecurity.com/files/155712/Netgear-R6400-Remote-Code-Execution.html · Exploit
• 🔥 https://kalypto.org/research/netgear-vulnerability-expanded · Exploit
• https://osv.dev/vulnerability/CVE-2016-6277 · Vendor Advisory
• http://kb.netgear.com/000036386/CVE-2016-582384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6277 · Security Note
• https://bdu.fstec.ru/vul/2023-01043 · Security Note
• https://t.me/cvenotify/108277 · Telegram Post
• https://t.me/nekaspersky/2117 · Telegram Post
• https://t.me/defcon_news/33324 · Telegram Post
• http://sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers · Note
• https://kb.cert.org/vuls/id/582384 · Note