CVE-2024-36787: Netgear WNR614 Auth Bypass Vulnerability

CVE-2024-36787 Overview

CVE-2024-36787 is an authentication bypass vulnerability in the Netgear WNR614 JNR1010V2 N300 router running firmware version 1.1.0.54_1.0.1. Attackers on an adjacent network can bypass authentication controls and access the administrative interface through unspecified vectors. The flaw is categorized under [CWE-1390] (Weak Authentication) and affects a discontinued consumer-grade wireless router. Successful exploitation grants full administrative control over the device, including network configuration, routing tables, and DNS settings.

Critical Impact
Adjacent network attackers can bypass authentication to gain complete administrative control of the router, enabling traffic interception, DNS redirection, and persistent network compromise.

Affected Products

Netgear WNR614 hardware (all revisions)
Netgear WNR614 firmware version 1.1.0.54_1.0.1
Netgear JNR1010V2 N300 variants running the affected firmware

Discovery Timeline

2024-06-07 - CVE-2024-36787 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36787

Vulnerability Analysis

The Netgear WNR614 administrative web interface fails to properly enforce authentication on protected resources. An attacker with adjacent network access, such as connectivity to the LAN or wireless segment, can reach administrative endpoints without providing valid credentials. The vulnerability is classified under [CWE-1390] (Weak Authentication), indicating the authentication mechanism can be circumvented rather than requiring credential brute-forcing.

Once administrative access is obtained, an attacker controls all router functions. This includes modifying firewall rules, changing DNS servers to redirect user traffic, updating firmware, and creating persistent backdoors. The Netgear WNR614 has reached end-of-life status, and no vendor patch is available.

Root Cause

The root cause is documented in the RedFox Security Advisory as improper enforcement of session and authentication checks within the router's web management interface. Protected pages can be accessed by manipulating request parameters or URLs in a manner that bypasses the login check.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be on the same local or wireless segment as the router. This constraint is reflected in the CVSS vector component AV:A. No user interaction and no prior privileges are required. Attackers within Wi-Fi range, including guests on an open or compromised SSID, can reach the vulnerable interface and execute the bypass.

See the RedFox Security Advisory for the disclosed technical details on the bypass technique.

Detection Methods for CVE-2024-36787

Indicators of Compromise

Unexpected DNS server entries or WAN configuration changes in the router's administrative settings
Administrative interface access originating from unrecognized MAC addresses on the LAN or Wi-Fi segments
Firmware version banner reporting 1.1.0.54_1.0.1 on internet-adjacent WNR614 devices
Modified firewall rules, port forwards, or new administrative accounts appearing without change records

Detection Strategies

Inventory network devices to identify Netgear WNR614 units and confirm firmware versions against the affected release
Monitor HTTP requests to the router administrative interface for direct access to protected endpoints without prior authentication requests
Capture and review DHCP and ARP logs for unfamiliar client devices connecting to the router's management network

Monitoring Recommendations

Log outbound DNS traffic from the router and alert on resolvers that do not match the organization's approved list
Alert on configuration changes to the router by periodically pulling and diffing the device configuration
Watch for unusual authentication events or session anomalies on hosts behind the router that could indicate traffic interception

How to Mitigate CVE-2024-36787

Immediate Actions Required

Replace affected Netgear WNR614 devices with a currently supported router model, as this product is end-of-life and no patch is available
Restrict access to the router's administrative interface to a dedicated management VLAN or trusted wired hosts only
Change all router credentials and rotate the Wi-Fi passphrase to invalidate any adjacent-network reconnaissance

Patch Information

No vendor security patch has been published for CVE-2024-36787. Netgear has not released fixed firmware for the WNR614, and the device is treated as end-of-life. Organizations must plan hardware replacement rather than rely on a software update.

Workarounds

Disable remote management and ensure the administrative interface is not reachable from the WAN
Segment the router onto an isolated network so untrusted wireless clients cannot reach the management interface
Disable the wireless radio when not required, reducing the adjacent-network attack surface
Deploy an upstream firewall to enforce egress DNS filtering, mitigating the impact if the router is compromised

bash

# Example: restrict management interface exposure at an upstream firewall
# Block inbound access to the router admin interface from untrusted VLANs
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.1.1 -p tcp --dport 443 -j DROP

# Force DNS through a trusted resolver to mitigate DNS hijacking risk
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination 9.9.9.9