CVE-2024-12847

9.8 criticalEPSS 30%

Critical (9.8) in netgear dgn1000 firmware. EPSS 30% chance of exploitation in the next 30 days.

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 30% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWEs: CWE-306, CWE-78
Published: 2025-01-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

netgear:dgn1000_firmware

References

https://seclists.org/bugtraq/2013/Jun/8
https://vulncheck.com/advisories/netgear-dgn
https://www.exploit-db.com/exploits/25978
https://www.exploit-db.com/exploits/43055

Check your stack JSON