Dgn1000 Firmware
CVE-2024-12847
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 71.3%, PoC available. Active exploitation since 2017. The DGN1000 is a widely deployed ADSL gateway. Many units are still in service on residential and small business networks. The router's root compromise provides a strategic vantage point for DNS hijacking, traffic interception, and botnet participation. |
| Exploit ScenarioDerived | Botnet scanning infrastructure identifies DGN1000 routers via HTTP fingerprinting. Automated exploit code sends a crafted request to setup.cgi, downloading and executing the botnet payload. Within seconds, the router joins a DDoS botnet. The operator modifies DNS settings to redirect all network traffic through attacker-controlled resolvers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
NETGEAR DGN1000 routers with firmware before 1.1.00.48 contain an unauthenticated remote command execution vulnerability via the setup.cgi endpoint. The vulnerability has been exploited in the wild since at least 2017, notably by the Mirai-derived Reaper/IoTroop botnet for large-scale DDoS operations.
Earlier versions of this analysis (1)
Unauthenticated root RCE in NETGEAR DGN1000 via setup.cgi actively exploited by IoT botnets since 2017.
RemediationAI
Update firmware to 1.1.00.48 or later. If the router is end-of-life, replace it immediately. Disable remote management access. Monitor network traffic for C2 communications from router IP addresses.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The setup.cgi endpoint on NETGEAR DGN1000 routers processes user input without authentication or sanitization, passing it directly to shell commands executed as root. The vulnerability is trivially exploitable via crafted HTTP requests. It has been weaponized in multiple botnet frameworks including Reaper/IoTroop and Mirai variants.
Know when Dgn1000 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.
Executive ViewAI
Organizations using NETGEAR DGN1000 before 1.1.00.48 face critical risk from CVE-2024-12847, a OS command injection vulnerability rated CVSS 9.8. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. With an EPSS score of 71%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC