CVE-2016-6277: listed in the CISA KEV catalog

CVE-2016-6277 · CVSS 8.8 HIGH · EPSS 99.8% · KEV 2022-03-07

NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.

Is CVE-2016-6277 exploited?

• Listed in the CISA KEV catalog on 2022-03-07.
• Federal remediation due 2022-09-07.
• Past that date by 1438 days.
• EPSS puts exploitation in the next 30 days at 99.8%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2016-6277

• Evooo1Bot Uses Routers as Stealth Proxy Nodes (2026-08-15)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/linux/http/netgear_r7000_cgibin_exec
• Exploit-DB 41598
• Exploit-DB 41598
• Exploit-DB 40889
• Nuclei template

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-15.