CVEvulnerability

CVE-2024-12847

9.8 CRITICAL Published 2025-01-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-01-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306, CWE-78

Description

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.

Affected configurations

• netgear dgn1000 firmware (< 1.1.00.48)

Related

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References