CVE-2024-36821
Published: 11 June 2024
Summary
CVE-2024-36821 is a medium-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Linksys Velop Whw0101 Firmware. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Services File Permissions Weakness (T1574.010); ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-36821 is an insecure permissions vulnerability affecting the Linksys Velop WiFi 5 (WHW01v1) router running firmware version 1.1.13.202617. The flaw, tracked under CWE-732 and CWE-379, permits unauthorized privilege escalation from a guest-level account to root due to improper permission assignments on system resources.
An attacker with physical access to the device can exploit the weakness without authentication or user interaction. Successful exploitation grants full root control, enabling arbitrary code execution, configuration changes, and access to sensitive data on the affected router.
The listed references point to Linksys customer release notes for the impacted firmware and a public GitHub repository containing technical details and proof-of-concept material. No separate advisory or patched firmware version is referenced in the available sources. The EPSS score has remained stable near 0.13 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36223
Vulnerability details
Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure 777 permissions on root-owned cron script (/tmp/cron/cron.everyminute/conntrack_collector.sh) enable file system permissions weakness exploitation (T1044), privilege escalation via cron abuse (T1068, T1053.003), and local account creation by appending to /etc/passwd (T1136.001).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures support proper permission assignment for critical resources through documented controls.
Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.
Prevents overly permissive assignments to critical resources by limiting to task needs.
Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.
Training on permission management reduces incorrect permission assignments for critical resources.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
Certification includes checking that permissions on critical resources are correctly assigned.