CVE-2024-30568: Netgear R6850 router command injection via c4-IPAddr parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction command execution plus a public exploit and very high EPSS percentile.

What it is

Netgear R6850 firmware 1.1.0.88 contains a command injection flaw reachable through the c4-IPAddr parameter. A remote, unauthenticated attacker can inject OS commands, and the vendor has published a security advisory page. The record does not state which firmware release fixes it.

Impact

Successful exploitation gives the attacker arbitrary command execution on the router, leading to full compromise of confidentiality, integrity and availability of the device.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction, so the vulnerable parameter is exposed over the network without authentication. The description does not specify which service or interface hosts the parameter.

Exploitation

Not listed in CISA KEV, but EPSS is 0.46918 (98.8th percentile) and the references include a public exploit write-up, indicating meaningful and elevated exploitation likelihood.

What to do

• Apply the fixed firmware from Netgear's security advisory page for the R6850; the record does not name a fixed version, so confirm with the vendor.
• If no fix is available, restrict management and WAN-facing access to the device and place it behind a firewall that blocks untrusted traffic to its web interface.
• Disable remote administration and UPnP on the router where not strictly required.
• Replace end-of-support units that will not receive firmware updates.
• Monitor the vendor advisory page for updated guidance.

Detection

• Inspect router and upstream logs for requests containing shell metacharacters in the c4-IPAddr parameter.
• Alert on unexpected outbound connections or processes spawned by the router's web service.
• Watch for configuration changes or new admin accounts on the device.
• Baseline normal traffic to the router's management interface and flag anomalous POST requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.