CVE-2024-12847Active Exploitation(netgear / dgn1000)

LOWCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for netgear dgn1000 systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.

3.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-78CWE-306

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • dgn1000
  • dgn1000_firmware

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 1 signal
  • Peaked 1d ago at 1 mentions (2026-08-17); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
Products
dgn1000dgn1000_firmware

1 version affected across 2 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-17: 1Mentions · 2026-10-02: 1Active Exploitation · 2026-08-17: 1Technical Details · 2026-08-17: 108-1710-02
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CrowdSec@Crowd_Security
    Active Exploitation

    🚨 In this week’s newsletter, we cover CVE-2024-12847, a critical RCE vulnerability affecting NETGEAR DGN1000 routers that has become the most-attacked flaw tracked by the CrowdSec Network. We break down how attackers are exploiting this decade-old vulnerability to take over routers and turn them into attack infrastructure. Read the full analysis and protect your systems 👉 https://www.crowdsec.net/vulntracking-report/cve-2024-12847-netgear-dgn1000-router-rce

    Post summary

    The post highlights that CVE‑2024‑12847, a critical RCE in NETGEAR DGN1000 routers, is actively exploited as the most‑attacked flaw in CrowdSec’s tracking, with no PoC or patch referenced here.

    01060811
    19.5K followersView on X
  • ♫Why♥Not♪@Python_s_

    NØØT Security Alerts Classification: High CVE: CVE-2024-12847 Product: NETGEAR / DGN1000 Summary: VulnCheck reports real-world exploitation activity affecting NETGEAR / DGN1000. Evidence: Active exploitation reported; Severe impact class; Live exploitation observed by VulnCheck canaries Impact: The vulnerability has a severe impact class such as code execution, authentication bypass, account takeover, or privilege escalation. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 01 Nov 2017 Source: https://vulncheck.com/ #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #NETGEAR #DGN1000 #CVE_2024_12847 #ActiveExploitation #Exploit

    0000029
    224 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
HWnetgeardgn1000---
OSnetgeardgn1000_firmware---

Explore more