NETGEAR DGN setup.cgi OS Command Injection

The impact of this vulnerability is severe. Successful exploitation allows an attacker to gain complete control over the affected NETGEAR DGN1000 router. This includes the ability to modify router configurations, intercept network traffic, install malware, and potentially pivot to other devices on the network. Given the router's position as a gateway, a compromised device can serve as a launchpad for broader network attacks. The observed exploitation by Shadowserver Foundation highlights the real-world risk and potential for widespread compromise, especially in environments with unpatched devices.

Small and medium-sized businesses (SMBs) relying on NETGEAR DGN1000 routers for internet connectivity are particularly at risk. Home users with unmanaged or poorly secured networks are also vulnerable. Shared hosting environments utilizing NETGEAR DGN1000 routers as gateway devices pose a significant risk due to the potential for lateral movement between hosted accounts.

• linux / server:

journalctl -u nginx -f | grep setup.cgi

• linux / server:

ps aux | grep setup.cgi

• linux / server:

find / -name setup.cgi -print 2>/dev/null

1. 2025-01-10Disclosure

   disclosure

2. 2025-02-06Exploitation

   exploit

1. 予約済み2024-12-20
2. 公開日2025-01-10
3. 更新日2026-04-07
4. EPSS 更新日2026-04-12

The primary mitigation for CVE-2024-12847 is to immediately upgrade affected NETGEAR DGN1000 routers to firmware version 1.1.00.48 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. While no direct WAF rules can prevent the underlying vulnerability, restricting access to the setup.cgi endpoint from untrusted networks can reduce the attack surface. Regularly monitor router logs for suspicious activity, particularly HTTP requests targeting setup.cgi. After upgrading, verify the fix by attempting to execute a simple command through the setup.cgi endpoint; the command should be rejected.