CVE-2024-57223
Published: 10 January 2025
Summary
CVE-2024-57223 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E7350 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 13.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Linksys E7350 firmware version 1.1.00.032 contains a command injection vulnerability in the apcli_wps_gen_pincode function, where the ifname parameter is processed without adequate sanitization. The flaw is tracked as CVE-2024-57223 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible unauthenticated exploitation that can fully compromise confidentiality, integrity, and availability.
An attacker with network reachability can supply a crafted ifname value to the affected function and execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker the same privileges as the web-management process, enabling actions such as configuration changes, credential theft, or persistent access without requiring user interaction or prior authentication.
The sole public reference is a technical disclosure containing proof-of-concept details for the injection vector. No vendor advisory or firmware patch addressing the issue is referenced in available materials. The EPSS score rose from a low baseline to a peak of 0.1398 on 2026-01-13 before receding to the current value of 0.0303, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53546
Vulnerability details
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via the ifname parameter in the router's apcli_wps_gen_pincode function enables remote exploitation of a public-facing web application (T1190) and arbitrary command execution on the network device (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by requiring validation and sanitization of the unsanitized ifname parameter in the apcli_wps_gen_pincode function.
Requires timely identification, reporting, and correction of the command injection flaw in the Linksys E7350 firmware to eliminate the vulnerability.
Vulnerability scanning would detect the command injection issue in the apcli_wps_gen_pincode function, enabling remediation before exploitation.