Multiple Routers - Authentication Bypass (CVE-2020-27866)

CVE-2020-27866 is an authentication bypass vulnerability affecting multiple NETGEAR routers, including models like R6020, R6080, and Nighthawk AC2100. Exploitable by network-adjacent attackers without authentication, the flaw resides in the mini_httpd service due to improper string matching when accessing protected pages. Successful exploitation could allow attackers to gain unauthorized access to router management interfaces and potentially execute code as root, leading to full device compromise. This vulnerability poses a significant risk for lateral movement and further attacks within local networks.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

CrowdSec network data shows that most actors exploiting CVE-2020-27866 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2020-27866 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending unauthenticated requests to URLs containing /setup.cgi?todo=debug&x=currentsetting.htm on affected NETGEAR routers, bypassing authentication to access sensitive device settings.