VulnerabilityPublished 30 Jan 2026

CVE-2026-24714: NETGEAR products · Inclusion of undocumented features or chicken bits

Affects NETGEAR productsSource CVE Database V5

Not known to be exploited · CVSS 7.5 High.

Data as of 26 Oct 2026, 14:05 UTC

CVSS 3.0 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 30 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
NETGEARNETGEAR products	Affected =versions which provide "TelnetEnable" functionality	Fixed in–

AI-suggested

European organizations should take immediate and specific steps to mitigate this vulnerability beyond generic advice. First, identify all NETGEAR devices in the network inventory and determine which models and firmware versions include the 'TelnetEnable' feature. For devices confirmed to be vulnerable, disable Telnet access entirely if the device interface allows it, or block Telnet ports (typically TCP 23) at network firewalls and internal segmentation points to prevent remote activation. If possible, replace end-of-service NETGEAR devices with supported models that receive security updates. For devices that must remain in use, isolate them on dedicated network segments with strict access controls and monitoring to detect anomalous magic packet traffic or Telnet activation attempts. Implement network intrusion detection systems (NIDS) with custom signatures to detect the specific magic packet pattern used to trigger TelnetEnable. Regularly audit device configurations and logs for signs of unauthorized Telnet activation or access. Engage with NETGEAR support or security advisories for any unofficial patches or workarounds. Finally, educate network administrators about the risks of undocumented features and the importance of decommissioning unsupported hardware.

Description

CVE-2026-24714 is a high-severity vulnerability affecting certain end-of-service NETGEAR products that include an undocumented 'TelnetEnable' feature. This feature allows an attacker to activate the Telnet service remotely by sending a specific magic packet, without requiring authentication or user interaction. Exploiting this vulnerability can lead to a complete compromise of the device's integrity, as attackers may gain unauthorized remote access. The vulnerability has a CVSS score of 7.5, indicating a significant risk, especially since it requires no privileges or user interaction and can be exploited over the network. Although no known exploits are currently reported in the wild, the presence of this backdoor-like functionality poses a serious threat. European organizations using affected NETGEAR devices should prioritize mitigation to prevent potential unauthorized access and control. The countries most likely affected are those with high NETGEAR market penetration and critical infrastructure relying on these devices, such as Germany, France, and the UK. Immediate mitigation steps include disabling Telnet if possible, applying any available firmware updates, and segmenting vulnerable devices from critical networks.

Impact

For European organizations, this vulnerability poses a substantial risk, especially for those relying on legacy NETGEAR networking equipment in critical infrastructure, enterprise networks, or sensitive environments. Unauthorized activation of Telnet could allow attackers to gain remote shell access, leading to unauthorized configuration changes, installation of malware, or lateral movement within the network. This compromises the integrity of network devices and can facilitate further attacks on connected systems. Since the vulnerability does not impact confidentiality directly, data leakage risk is lower, but the integrity compromise can disrupt network operations and trustworthiness of network devices. The lack of authentication and user interaction requirements means attackers can exploit this remotely and silently, increasing the likelihood of undetected breaches. European sectors such as telecommunications, government, healthcare, and finance, which often use NETGEAR devices for network connectivity, could face operational disruptions and increased risk of espionage or sabotage. The end-of-service status of affected devices means no official patches are likely forthcoming, complicating remediation efforts and increasing long-term exposure.

Summary

CVE-2026-24714 identifies a vulnerability in certain NETGEAR products that have reached end-of-service status but still include an undocumented feature known as 'TelnetEnable.' This feature can be triggered remotely by sending a specially crafted magic packet, which activates the Telnet service on the device without any authentication or user interaction. Telnet is a legacy protocol known for transmitting data in plaintext, making it inherently insecure. The activation of Telnet via this hidden feature effectively creates a backdoor, allowing attackers to gain unauthorized remote access to the device. The vulnerability is network exploitable (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and affects the integrity of the device (I:H) but not confidentiality or availability. The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, resulting in a score of 7.5, classified as high severity. Although no public exploits have been reported yet, the risk is significant due to the ease of exploitation and potential for attackers to manipulate device configurations or pivot into internal networks. The vulnerability primarily affects versions of NETGEAR products that still retain this 'TelnetEnable' functionality, typically older or end-of-life models. The lack of official patches or updates for these end-of-service devices increases the risk for organizations that continue to use them. The presence of such undocumented features is a known security anti-pattern, as it bypasses normal security controls and can be exploited by attackers who discover the magic packet signature.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Feb 2026, 08:47 UTC

Technical details

References

Community reviews

Related threats