Multiple CVEs Enable Remote Command Execution on Vulnerable Routers and Servers

• •CVE-2016-6277 affects multiple NETGEAR routers, allowing remote command execution.
• •CVE-2007-3010 impacts Alcatel OmniPCX servers, enabling similar exploitation methods.
• •Both vulnerabilities are actively exploited and listed in CISA's Known Exploited Vulnerabilities Catalog.

Two critical vulnerabilities have been identified that allow remote attackers to execute arbitrary commands. CVE-2016-6277 affects various NETGEAR routers, including R6250, R6400, and R7000, allowing exploitation through shell metacharacters in the path info to cgi-bin. CVE-2007-3010 impacts Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier, enabling similar command execution via the user parameter during a ping action. Both vulnerabilities have been added to the CISA Known Exploited Vulnerabilities Catalog, indicating active exploitation. Users of the affected systems are advised to consult the CISA guidance for remediation steps. The vulnerabilities pose significant risks to network security and operational integrity.