NETGEAR Routers cgi-bin Path Info Shell Metacharacter Remote Code Execution (RCE) Vulnerability (CVE-2016-6277)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2016-6277) exists in the built-in web server of various NETGEAR wireless router models. When processing HTTP requests directed to the cgi-bin/ directory, the web server fails to properly sanitize or validate user-supplied input within the URL path info before passing it to a system shell command. This lack of input validation leads to a critical Command Injection vulnerability, allowing attackers to execute arbitrary operating system commands.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web administration interface (typically on port 80 or 8080). By appending shell metacharacters such as semicolons (;) or ampersands (&) followed by system commands to the cgi-bin/ path (e.g., http://<router-ip>/cgi-bin/;[command]), the web server's command parser interprets and executes the injected payload with root privileges. This vulnerability can also be triggered via Cross-Site Request Forgery (CSRF), allowing external attackers to compromise internal routers if a local user visits a malicious link.

3. Infrastructure & Business Impact

Listed in the CISA KEV (Known Exploited Vulnerabilities) catalog with an EPSS score of 0.998, this vulnerability is actively exploited in the wild. Successful exploitation grants the attacker complete administrative (root) control over the affected router. This enables malicious actors to intercept internal network traffic, alter DNS settings to redirect users to phishing sites, or enlist the compromised device into botnets for launching distributed denial-of-service (DDoS) attacks.