Cyber Resilience

CVE-2024-57224

CriticalPublic PoCRCE

Published: 10 January 2025

Published
10 January 2025
Modified
16 April 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0386 88.5th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57224 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E7350 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

Linksys E7350 firmware version 1.1.00.032 contains a command injection vulnerability in the apcli_do_enr_pin_wps function, where the ifname parameter is processed without adequate sanitization. The flaw is tracked as CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction.

An unauthenticated remote attacker can supply a crafted ifname value to the affected function and execute arbitrary operating-system commands on the device, resulting in full compromise of confidentiality, integrity, and availability.

The associated EPSS score rose from a low baseline to a peak of 0.1080 on 2026-01-13 before receding to the current value of 0.0386, indicating a period of increased exploitation interest after public disclosure. A single public reference provides technical details of the issue but contains no vendor advisory or patch information.

EU & UK References

Vulnerability details

Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

The command injection vulnerability in the router's apcli_do_enr_pin_wps function via the ifname parameter allows remote exploitation of a public-facing web application/service (T1190, T1210), enabling arbitrary command execution equivalent to network device CLI access (T1059.008).

CVEs Like This One

CVE-2024-57228Same product: Linksys E7350
CVE-2024-57227Same product: Linksys E7350
CVE-2024-57226Same product: Linksys E7350
CVE-2024-57223Same product: Linksys E7350
CVE-2024-57225Same product: Linksys E7350
CVE-2024-57536Same vendor: Linksys
CVE-2025-29229Same vendor: Linksys
CVE-2025-29228Same vendor: Linksys
CVE-2025-8827Same vendor: Linksys
CVE-2025-29230Same vendor: Linksys

Affected Assets

linksys
e7350 firmware
1.1.00.032

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of user inputs like the ifname parameter to prevent command injection in the apcli_do_enr_pin_wps function.

prevent

Mandates identification, reporting, and correction of the specific command injection flaw through firmware updates or patches.

prevent

Restricts or disables nonessential capabilities such as the vulnerable WPS enrollment function to eliminate exposure to exploitation.

References