CVE-2024-57225
Published: 10 January 2025
Summary
CVE-2024-57225 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E7350 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of the devname parameter in the reset_wifi function to block command injection exploits.
Mandates identification, reporting, and remediation of the command injection flaw via firmware patches or updates for the Linksys E7350.
Enforces access authorizations to require authentication before accessing the vulnerable reset_wifi function, blocking unauthenticated remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via the devname parameter in the router's reset_wifi web function enables exploitation of a public-facing application for remote code execution.
NVD Description
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
Deeper analysisAI
CVE-2024-57225 is a command injection vulnerability affecting the Linksys E7350 router at version 1.1.00.032. The issue resides in the reset_wifi function, where the devname parameter fails to properly sanitize user input, allowing injection of arbitrary commands. Classified under CWE-77, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
Remote attackers can exploit this vulnerability over the network without requiring authentication, privileges, or user interaction. Exploitation enables full command execution on the device, compromising confidentiality, integrity, and availability to a high degree, which could lead to complete router takeover, data theft, or further network pivoting.
Details on the vulnerability, including a proof-of-concept, are documented in the GitHub repository at https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_7_reset_wifi/README.md. No official vendor advisories or patch information are specified in available data.
Details
- CWE(s)