Loading vulnerability…
Remote OS command injection in NETGEAR routers
CVE-2016-6277 is an OS command-injection vulnerability in the web interface of multiple NETGEAR routers. Shell metacharacters in CGI path information allow remote attackers to execute arbitrary commands. Affected models include R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, and D7000; other models may also be affected. Exploitation has been associated with Mirai variants, BotenaGo, LiquorBot, Enemybot, and Evooo1Bot.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables remote execution of arbitrary operating-system commands on the router. Attackers have used this vulnerability to infect devices with botnet malware. Depending on the installed payload, subsequent capabilities can include remote administration, persistence, DDoS attacks, credential interception, cryptocurrency mining, and proxying attacker traffic. These are post-compromise malware capabilities rather than independently established direct effects of the vulnerability.
If you can’t patch tonight, do this now.
Use intrusion-prevention coverage for this command-injection vulnerability; FortiGuard lists the NETGEAR.WebServer.Module.Command.Injection signature. Monitor vulnerable devices for unexpected outbound connections and signs of botnet compromise. Detection and network filtering do not replace firmware remediation.
Patch, then assume compromise.
Install vendor firmware that fixes CVE-2016-6277 for the exact router model. Identified fixed-version boundaries are R6250 1.0.4.6.Beta, R6400 1.0.1.18.Beta, R6700 1.0.1.14.Beta, R7000 1.0.7.6.Beta, R7100LG 1.0.0.28.Beta, R7300DST 1.0.0.46.Beta, R7900 1.0.1.8.Beta, and R8000 1.0.3.26.Beta. Specific fixed versions for R6900, D6220, D6400, and D7000 are not available in the supplied vulnerability details. Replace exposed legacy appliances when security updates are unavailable.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.