CVE-2024-12847

NETGEAR DGN setup.cgi OS Command Injection

State: Published
Severity: 9.8 Critical
Published: Jan 10, 2025
Updated: Apr 7, 2026
Reserved: Dec 20, 2024

Description

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
DGN1000NETGEAR	before 1.1.00.48Affected

References

https://seclists.org/bugtraq/2013/Jun/8third-party-advisorytechnical-description
https://www.exploit-db.com/exploits/25978exploit
https://www.exploit-db.com/exploits/43055exploit
https://vulncheck.com/advisories/netgear-dgnthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.