# CVE-2024-57046: DGN2200 - Authentication Bypass

> Live exploitation tracking for CVE-2024-57046 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-57046

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** NETGEAR DGN2200
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** iot, management_panel

## Description

A vulnerability in the NETGEAR DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the the requested url, it will be recognized as passing the authentication.

## CrowdSec analysis

[CVE-2024-57046](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-57046) is an authentication bypass vulnerability in the Netgear DGN2200 router (firmware v1.0.0.46 and earlier), where appending "?x=1.gif" to a URL allows attackers to access protected resources without valid credentials. This flaw could be exploited by unauthorized users to gain full control over the router’s administrative interface, potentially leading to network compromise, data theft, or further attacks on connected devices.

CrowdSec has been tracking this vulnerability and its exploits since 15th of April 2026.

CrowdSec network observations suggest that most exploitation of CVE-2024-57046 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-57046 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by appending `?x=1.gif` to administrative URLs on Netgear DGN2200 routers, bypassing authentication controls and gaining unauthorized access to configuration and status pages.

## Timeline

- 2025-02-18: CVE Published. CVE-2024-57046 is published to NVD.
- 2026-04-15: Rule Released. CrowdSec releases a rule to detect CVE-2024-57046 exploitation attempts against the CrowdSec Network.
- 2026-05-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-57046 for the first time.

## References

- https://www.netgear.com/about/security/
- https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/DGN2200/ACL%20bypass%20Vulnerability%20in%20Netgear%20DGN2200.md
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57046.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-57046) follows observed exploitation activity for CVE-2024-57046. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.