CVE-2024-57224
Published: 10 January 2025
Summary
CVE-2024-57224 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E7350 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Linksys E7350 firmware version 1.1.00.032 contains a command injection vulnerability in the apcli_do_enr_pin_wps function, where the ifname parameter is processed without adequate sanitization. The flaw is tracked as CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated remote attacker can supply a crafted ifname value to the affected function and execute arbitrary operating-system commands on the device, resulting in full compromise of confidentiality, integrity, and availability.
The associated EPSS score rose from a low baseline to a peak of 0.1080 on 2026-01-13 before receding to the current value of 0.0386, indicating a period of increased exploitation interest after public disclosure. A single public reference provides technical details of the issue but contains no vendor advisory or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53547
Vulnerability details
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The command injection vulnerability in the router's apcli_do_enr_pin_wps function via the ifname parameter allows remote exploitation of a public-facing web application/service (T1190, T1210), enabling arbitrary command execution equivalent to network device CLI access (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of user inputs like the ifname parameter to prevent command injection in the apcli_do_enr_pin_wps function.
Mandates identification, reporting, and correction of the specific command injection flaw through firmware updates or patches.
Restricts or disables nonessential capabilities such as the vulnerable WPS enrollment function to eliminate exposure to exploitation.