CVE-2024-57046
Published: 18 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-57046 is an authentication bypass vulnerability (CWE-287) in the Netgear DGN2200 router running firmware version v1.0.0.46 and earlier. The flaw allows unauthorized individuals to circumvent authentication by appending "?x=1.gif" to any requested URL, causing the router to treat the request as authenticated.
Attackers on an adjacent network (AV:A) can exploit this with low complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N). Successful exploitation provides high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 8.8, enabling potential full administrative control of the device.
Advisories and mitigation guidance are detailed in the GitHub security report at https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/DGN2200/ACL%20bypass%20Vulnerability%20in%20Netgear%20DGN2200.md and on Netgear's security portal at https://www.netgear.com/about/security/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes an authentication bypass vulnerability in the Netgear DGN2200 router's web management interface via a URL parameter (?x=1.gif), enabling exploitation of a public-facing application to gain unauthorized administrative access.