CVE-2024-12847

Katalog CVE

CVSS 9.8 · Critical EPSS 29,9%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada netgear dgn1000 firmware. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.

Rincian

Terbit di NVD

10 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

29,9% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vulncheck.com/advisories/netgear-dgn advisory vendor
• https://seclists.org/bugtraq/2013/Jun/8 mailing list · advisory pihak ketiga
• https://www.exploit-db.com/exploits/25978 exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/43055 exploit · vdb entry