CVE-2024-42756
Published: 23 August 2024
Summary
CVE-2024-42756 is a high-severity Code Injection (CWE-94) vulnerability in Netgear Dgn1000Ww Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-42756 is a code injection vulnerability, tracked as CWE-94, affecting the Netgear DGN1000WW wireless router at firmware version 1.1.00.45. The flaw resides in the Diagnostics page and carries a CVSS 3.1 base score of 8.8, reflecting an adjacent-network attack vector that requires no authentication or user interaction.
An unauthenticated attacker positioned on the same network segment can submit crafted input to the Diagnostics page, resulting in arbitrary code execution on the device. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the router.
Public references include a detailed proof-of-concept on GitHub and Netgear’s general security advisory page, although the references do not enumerate specific firmware patches or configuration mitigations. The associated EPSS score currently stands at 0.2019 with a recorded peak of 0.2061.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39761
Vulnerability details
An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.