CVE-2024-12847
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.
Analysis
NETGEAR DGN1000 routers with firmware before 1.1.00.48 contain an unauthenticated remote command execution vulnerability via the setup.cgi endpoint. The vulnerability has been exploited in the wild since at least 2017, notably by the Mirai-derived Reaper/IoTroop botnet for large-scale DDoS operations.
Technical Context
The setup.cgi endpoint on NETGEAR DGN1000 routers processes user input without authentication or sanitization, passing it directly to shell commands executed as root. The vulnerability is trivially exploitable via crafted HTTP requests. It has been weaponized in multiple botnet frameworks including Reaper/IoTroop and Mirai variants.
Affected Products
['NETGEAR DGN1000 firmware < 1.1.00.48']
Remediation
Update firmware to 1.1.00.48 or later. If the router is end-of-life, replace it immediately. Disable remote management access. Monitor network traffic for C2 communications from router IP addresses.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today