CVE-2024-12847: netgear dgn1000_firmware OS Command Injection
Vulnerability summary
CVE-2024-12847 is a critical (CVSS 9.8) OS Command Injection vulnerability in netgear dgn1000_firmware. EPSS estimates a 30.36% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 10-01-2025PublishedVulnerability first disclosed.
- 07-04-2026Last modifiedVulnerability information updated.
Description
NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
30.36%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+0.43 pp
From 29.94% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundNetgear DGN1000 / DGN2200 - Multiple Vulnerabilities
Maturity: poc
Netgear DGN1000 1.1.00.48 - 'Setup.cgi' Remote Code Execution (Metasploit)
Maturity: weaponized
Netgear DGN1000 Setup.cgi Unauthenticated RCE
exploit/linux/http/netgear_dgn1000_setup_unauth_exec
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Netgear1 product
- dgn1000_firmware< 1.1.00.48
1 vendor · 1 product