CVE-2024-54803
Published: 31 March 2025
Summary
CVE-2024-54803 is a critical-severity Code Injection (CWE-94) vulnerability in Netgear Wnr854T Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
Netgear WNR854T firmware version 1.5.2 for the North American market is affected by a command injection vulnerability. The flaw resides in the post.cgi handler, which processes an nvram parameter named pppoe_peer_mac without adequate input validation, enabling an attacker to inject operating-system commands that execute after a device reboot.
An unauthenticated remote attacker can exploit the issue by sending a single specially crafted HTTP request over the network. Successful exploitation grants the attacker full control over the router, including the ability to execute arbitrary commands with the privileges of the web-management process, resulting in complete compromise of confidentiality, integrity, and availability.
The EPSS score for this CVE rose from low values to a peak of 0.1025 on 2026-03-14 before receding, indicating that exploitation interest emerged after public disclosure and that the vulnerability warrants renewed attention from defenders.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54343
Vulnerability details
Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter pppoe_peer_mac and forcing a reboot. This will result in command injection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes remote unauthenticated command injection via a public-facing web script (post.cgi) on a router, directly enabling T1190 for initial access and T1059.004 for arbitrary Unix shell command execution on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by requiring validation of untrusted inputs like the pppoe_peer_mac parameter in post.cgi against expected format and content.
Enforces approved authorizations, preventing unauthenticated remote access to sensitive NVRAM update functions in post.cgi that enable the injection.
Requires timely remediation of the specific command injection flaw in the router firmware via patching or updates.