NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability.

CVE-2024-12847 is an unauthenticated OS command injection in the setup.cgi endpoint of the NETGEAR DGN1000 (firmware < 1.1.00.48) and DGN2200 v1 DSL modem-routers. The syscmd function passes HTTP parameters directly to a shell without sanitization, granting root-level RCE to any attacker who can reach the web management interface. A Metasploit module (exploit/linux/http/netgear_dgn1000_setup_unauth_exec) has existed since 2013, and Mirai-family botnets have been mass-exploiting these devices for years. FOFA/Hunter scans report ~327K exposed instances globally.

The vendor's CVSS 9.8 is technically accurate for the vulnerability mechanics — unauthenticated, network-reachable, no user interaction, full compromise. However, for enterprise patch-management triage, the score overstates urgency because: (1) the DGN1000 is a consumer-grade SOHO DSL modem-router, not enterprise infrastructure; (2) the device is End-of-Life with no firmware updates forthcoming — the action is *replacement*, not *patching*; (3) the realistic enterprise installed base is near-zero. The real risk is shadow-IT units in branch offices, acquired-company locations, or employee home networks bridging into corporate VPN.

Why this verdict

• Trivial exploitability: Unauthenticated, no user interaction, public Metasploit module since 2013 — attack complexity is effectively zero.
• Active botnet exploitation: Mirai variants and other IoT botnets have weaponized this since at least 2017. This is not theoretical.
• EOL with no remediation path: The device cannot be patched — only replaced. This changes the defender's action from 'apply update' to 'find and decommission.'
• Role multiplier: The DGN1000 is a network edge appliance (router/gateway). If present, it IS the perimeter. Compromise grants the attacker a position to intercept all traffic and pivot into the LAN. However, the DGN1000 is consumer-grade SOHO equipment — estimated <0.1% of enterprise network edge devices are DGN1000 units. The floor for network-edge devices applies, but the near-zero enterprise installed base caps the verdict at HIGH rather than CRITICAL.
• Friction — consumer device class: Enterprise procurement and network architecture standards exclude consumer DSL modem-routers. Presence in enterprise is limited to shadow IT, acquired-company remnants, or employee home offices.

Why not higher?

The DGN1000 is a discontinued consumer SOHO device, not enterprise-class infrastructure. An enterprise fleet of 10,000 managed hosts has effectively zero DGN1000 units unless there is uncontrolled shadow IT or an acquisition tail. The network-edge role floor is satisfied at HIGH, but elevating to CRITICAL requires ≥10% of the installed base occupying the high-value role — and the entire installed base of this product sits outside the enterprise perimeter.

Why not lower?

Despite the consumer device class, this vulnerability has confirmed active exploitation by botnets since 2017, a public Metasploit module, and zero authentication requirements. Any DGN1000 in the environment — even in a branch office or home-office VPN scenario — is a fully compromised perimeter device the moment it's internet-reachable. The blast radius of a compromised gateway (traffic interception, DNS hijacking, LAN pivot) prevents downgrading below HIGH.

1. Run an asset discovery scan for NETGEAR OUI and DGN1000 HTTP banners — You can't patch what you can't find. Use your NAC, network scanner, or DHCP logs to identify any DGN1000/DGN2200v1 devices. Shodan/Censys queries against your external IP ranges will catch internet-exposed units. Complete this within the noisgate mitigation SLA of 30 days.
2. Decommission and replace any discovered units immediately — There is no safe firmware version for the DGN2200v1, and the DGN1000 fix (1.1.00.48) is ancient and the device is EOL. Replace with a supported, enterprise-managed router or access point. Do not attempt to 'harden' these devices — they are fundamentally unsupportable.
3. Block management interface access at the upstream firewall — If immediate replacement is not possible, ACL the device's management port (80/8080) so it is unreachable from untrusted networks. This is a stopgap — the device is still vulnerable to anyone on the local segment.
4. Audit VPN split-tunnel policies for home-office workers — If employees use personal routers (potentially DGN1000s) for VPN, ensure split-tunneling is disabled so corporate traffic does not traverse a compromised home gateway. This limits the blast radius of a home-router compromise.

Run this script from any Linux/macOS workstation that can reach the target device's management interface over HTTP. Usage: bash check_dgn1000.sh <target_ip> [port]. No special privileges required — it only sends an HTTP GET request.

#!/usr/bin/env bash
# check_dgn1000.sh — Detect NETGEAR DGN1000/DGN2200v1 setup.cgi exposure
# Usage: bash check_dgn1000.sh <target_ip> [port]
# Exit codes: 1=VULNERABLE, 0=PATCHED/NOT_AFFECTED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <target_ip> [port]}"
PORT="${2:-80}"
URL="http://${TARGET}:${PORT}/setup.cgi"
TIMEOUT=10

echo "[*] Checking ${URL} for NETGEAR DGN1000 setup.cgi exposure..."

# First, check if the host responds and identifies as NETGEAR DGN
BANNER=$(curl -sI --connect-timeout "$TIMEOUT" "http://${TARGET}:${PORT}/" 2>/dev/null || true)

if echo "$BANNER" | grep -qi 'DGN1000\|DGN2200'; then
    echo "[!] NETGEAR DGN1000/DGN2200 detected in HTTP headers."
else
    # Try to fetch the login page for device identification
    BODY=$(curl -s --connect-timeout "$TIMEOUT" "http://${TARGET}:${PORT}/" 2>/dev/null || true)
    if echo "$BODY" | grep -qi 'DGN1000\|DGN2200'; then
        echo "[!] NETGEAR DGN1000/DGN2200 detected in page content."
    else
        echo "[*] Target does not appear to be a NETGEAR DGN1000/DGN2200."
        echo "PATCHED"
        exit 0
    fi
fi

# Check if setup.cgi is reachable without authentication
# We use a harmless, non-destructive probe — just check HTTP status
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout "$TIMEOUT" "${URL}" 2>/dev/null || echo "000")

if [ "$HTTP_CODE" = "000" ]; then
    echo "[?] Could not connect to ${URL}."
    echo "UNKNOWN"
    exit 2
elif [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "302" ]; then
    echo "[!] setup.cgi is accessible without authentication (HTTP $HTTP_CODE)."
    echo "[!] This device is an EOL NETGEAR DGN with exposed management — CVE-2024-12847."
    echo "VULNERABLE"
    exit 1
elif [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ]; then
    echo "[*] setup.cgi returned HTTP $HTTP_CODE — authentication may be enforced."
    echo "[*] Device is still EOL and should be replaced regardless."
    echo "VULNERABLE"
    exit 1
else
    echo "[?] Unexpected HTTP status: $HTTP_CODE. Manual verification required."
    echo "UNKNOWN"
    exit 2
fi

Sources

1. NVD — CVE-2024-12847
2. Rapid7 Metasploit Module — NETGEAR DGN1000B setup.cgi
3. CyberInsider — Flaw in EoL Netgear Router Actively Exploited Since 2017
4. NETGEAR End of Service Page
5. Unit 42 — Mirai Campaign Leveraging IoT Exploits
6. Exploit-DB — NETGEAR DGN1000 Setup.cgi RCE (Metasploit)
7. VulnCheck Advisory — NETGEAR DGN setup.cgi
8. GitHub Advisory — GHSA-pq8m-gwqp-g9xv