{"id":"CVE-2024-12847","published":"2025-01-10T19:36:36Z","modified":"2026-04-07T14:08:27Z","title":"NETGEAR DGN setup.cgi OS Command Injection","vendor":"NETGEAR","product":"DGN1000","tier":"core","eol":null,"affectedVersions":[{"vendor":"NETGEAR","product":"DGN1000","versions":["< 1.1.00.48"]}],"description":{"text":"NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.","provenance":"source","from":"CVE.org"},"summary":{"text":"The NETGEAR DGN1000 firmware (versions before 1.1.00.48) contains an OS command injection flaw in its setup.cgi endpoint, which fails to neutralize special elements in user-supplied input and lacks authentication for this critical functionality. An unauthenticated remote attacker with network access to the device can send crafted HTTP requests to setup.cgi, with no user interaction or prior configuration required, to execute arbitrary operating system commands as root.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.30364,"percentile":0.98228,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2017-11-01","exploitedFirstSeen":"2017-11-01","ransomware":false,"evidence":[{"url":"https://www.fortiguard.com/encyclopedia/ips/44738","date":"2017-11-01"},{"url":"https://unit42.paloaltonetworks.com/hide-n-seek-botnet-updates-arsenal-with-exploits-against-nexus-repository-manager-thinkphp/","date":"2019-06-12"},{"url":"https://www.fortiguard.com/outbreak-alert/router-malware-attack","date":"2023-02-01"},{"url":"https://unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/","date":"2023-06-22"},{"url":"https://viz.greynoise.io/tags/netgear-dgn-setup-cgi-cve-2024-12847-command-execution-attempt?days=30","date":"2025-01-10"},{"url":"https://www.cve.org/cverecord?id=CVE-2024-12847","date":"2025-01-10"},{"url":"https://isc.sans.edu/diary/The+Curious+Case+of+a+12YearOld+Netgear+Router+Vulnerability/31592/","date":"2025-01-15"},{"url":"https://isc.sans.edu/diary/PCAPs%20or%20It%20Didn%27t%20Happen%3A%20Exposing%20an%20Old%20Netgear%20Vulnerability%20Still%20Active%20in%202025%20%5BGuest%20Diary%5D/31638","date":"2025-01-30"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-12847","date":"2025-06-07"},{"url":"https://www.trendmicro.com/en_us/research/25/j/rondodox.html","date":"2025-10-09"}],"evidenceTotal":294,"provenance":"source"},"exploited":true,"otx":{"pulseCount":14,"pulses":[{"name":"151.101.0.22","url":"https://otx.alienvault.com/pulse/698918baac756a084ef67089","created":"2026-02-08"},{"name":"hostasa.org","url":"https://otx.alienvault.com/pulse/698910e3f78fe72e45c8e068","created":"2026-02-08"},{"name":"hostasa.org","url":"https://otx.alienvault.com/pulse/698910df5a3e7798d4da271a","created":"2026-02-08"},{"name":"Hybrid Managed Service Actor / provisioned insider","url":"https://otx.alienvault.com/pulse/6989077aa8c925b423ef9354","created":"2026-02-08"},{"name":"Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode","url":"https://otx.alienvault.com/pulse/698904c316bc7710b967d01d","created":"2026-02-08"},{"name":"zero trust","url":"https://otx.alienvault.com/pulse/6988faa4f668aeeed6f86da8","created":"2026-02-08"},{"name":"RondoDox | Guest System attacking | EuroTarget","url":"https://otx.alienvault.com/pulse/696a8dc74871e9a34cab06a6","created":"2026-01-16"},{"name":"COINBASE CARTEL - RedPacketSecurity[.]com • CVE BANK","url":"https://otx.alienvault.com/pulse/6935ef5c19e35c43e6908694","created":"2025-12-07"},{"name":"New Exploits | CVE’s | 12.07.2025","url":"https://otx.alienvault.com/pulse/6935d7d4979c94d296e4b033","created":"2025-12-07"},{"name":"RondoDox v2: Evolution of RondoDox Botnet with 650% More Exploits","url":"https://otx.alienvault.com/pulse/6911c73e9d8c6d03d8d71b34","created":"2025-11-10"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://seclists.org/bugtraq/2013/Jun/8","tags":["third-party-advisory","technical-description"]},{"url":"https://www.exploit-db.com/exploits/25978","tags":["exploit"]},{"url":"https://www.exploit-db.com/exploits/43055","tags":["exploit"]},{"url":"https://vulncheck.com/advisories/netgear-dgn","tags":["third-party-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-51148","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-51148","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Netgear DGN1000 Setup.cgi Unauthenticated RCE","module":"exploit/linux/http/netgear_dgn1000_setup_unauth_exec","type":"exploit","disclosureDate":"2013-06-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb"}],"first":{"date":"2013-06-05","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/25978","https://www.exploit-db.com/exploits/43055"],"flow":[],"timeline":[{"date":"2013-06-05","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb","provenance":"source"},{"date":"2017-11-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortiguard.com/encyclopedia/ips/44738","provenance":"source"},{"date":"2025-01-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-12847","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":69.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3286 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.65,"detail":"percentile 0.9823"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.67,"detail":"14 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}