# CVE-2020-27866: Multiple Routers - Authentication Bypass

> Live exploitation tracking for CVE-2020-27866 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-27866

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** NETGEAR Multiple Routers
- **Weaknesses:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel); CWE-287 (Improper Authentication)
- **Tags:** iot

## Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.

## CrowdSec analysis

[CVE-2020-27866](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-27866) is an authentication bypass vulnerability affecting multiple NETGEAR routers, including models like R6020, R6080, and Nighthawk AC2100. Exploitable by network-adjacent attackers without authentication, the flaw resides in the mini_httpd service due to improper string matching when accessing protected pages. Successful exploitation could allow attackers to gain unauthorized access to router management interfaces and potentially execute code as root, leading to full device compromise. This vulnerability poses a significant risk for lateral movement and further attacks within local networks.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

CrowdSec network data shows that most actors exploiting CVE-2020-27866 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2020-27866 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending unauthenticated requests to URLs containing `/setup.cgi?todo=debug&x=currentsetting.htm` on affected NETGEAR routers, bypassing authentication to access sensitive device settings.

## Timeline

- 2021-02-11: CVE Published. CVE-2020-27866 is published to NVD.
- 2026-01-21: Rule Released. CrowdSec releases a rule to detect CVE-2020-27866 exploitation attempts against the CrowdSec Network.
- 2026-02-02: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2020-27866 for the first time.

## References

- https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
- https://www.zerodayinitiative.com/advisories/ZDI-20-1451/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27866.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-27866) follows observed exploitation activity for CVE-2020-27866. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.