Flaw in EoL Netgear Router Actively Exploited Since 2017

A critical authentication bypass vulnerability in NETGEAR's DGN1000 router (CVE-2024-12847) has been actively exploited in the wild for several years, enabling attackers to execute arbitrary system commands with root privileges. Despite the problem being known since at least 2013, the product has reached End-of-Life (EOL) status, meaning no further security updates will be issued to address this critical flaw.

Vulnerability details

This vulnerability, present in NETGEAR DGN1000 firmware versions prior to 1.1.00.48, allows remote and unauthenticated attackers to exploit the setup.cgi endpoint via specially crafted HTTP requests. Once exploited, attackers can gain full control over the device, leveraging it for various malicious purposes, including data theft, network intrusion, or launching attacks on other systems.

The issue was initially discovered and disclosed in 2013 by security researcher Roberto Paleari. The flaw lies in the embedded web server's failure to enforce authentication checks for specific URLs containing the substring currentsetting.htm. By abusing this weakness, attackers can directly execute commands on the router using the setup.cgi script.

Context and impact

NETGEAR's DGN1000 is a budget-friendly ADSL router primarily marketed for home and small office use. Its compact design and affordability led to widespread adoption, making it a common target for attackers. The device’s firmware has not been updated since version 1.1.00.48 was released to address the flaw for supported users. However, with the product reaching EOL status, many routers remain vulnerable, as owners either failed to apply the final patch or used unsupported firmware versions.

This vulnerability has a CVSS v3.1 score of 9.8 (Critical), reflecting its ease of exploitation and the severe impact on confidentiality, integrity, and availability. Reports suggest exploitation has been ongoing since at least 2017, with attackers using compromised devices to form botnets or perform man-in-the-middle (MITM) attacks.

Security recommendations

As NETGEAR no longer supports the DGN1000, users are urged to take the following steps to mitigate the risk:

• Replace the device – Since no patches will be released, the safest course of action is to replace the router with a modern, secure alternative supported by the manufacturer.
• Disable remote management – If replacing the device is not immediately feasible, disable remote management functionality in the router's settings to limit the attack surface.
• Isolate the device – Place the router on a separate network or VLAN to minimize potential damage from a compromise.
• Apply the final firmware update – If still using firmware older than 1.1.00.48, update to the final release to address the specific flaw in setup.cgi.