KEVIntel
Back to KEVs
9.8
CVSS
Critical

CVE-2024-12847

PUBLISHED

NETGEAR DGN setup.cgi OS Command Injection

Exploited in the wild Remote Low complexity No user interaction
Vendor
NETGEAR
Product
DGN1000
Published
Jan 10, 2025
EPSS
—

Description

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.

edge

CVSS scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2025-01-10 19:36:36 UTC · Source

SSVC decision points

Exploitation
poc
Automatable
Yes
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CVE Jan 10, 2025

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel