CVE-2024-57225
Published: 10 January 2025
Summary
CVE-2024-57225 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E7350 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-57225 is a command injection vulnerability in the Linksys E7350 wireless router running firmware version 1.1.00.032. The flaw exists in the reset_wifi function, where the devname parameter is processed without adequate sanitization, allowing arbitrary command execution as described under CWE-77.
An unauthenticated attacker with network access can supply a malicious devname value to the affected endpoint and achieve full control over the device, including the ability to read, modify, or delete data and disrupt services. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting that exploitation requires no privileges or user interaction.
The single public reference is a technical write-up containing proof-of-concept details rather than an official vendor advisory or patch. Exploitation probability, as measured by EPSS, rose from a low baseline to a peak of 0.1398 before receding to the current value of 0.0303, indicating a period of increased interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53548
Vulnerability details
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via the devname parameter in the router's reset_wifi web function enables exploitation of a public-facing application for remote code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the devname parameter in the reset_wifi function to block command injection exploits.
Mandates identification, reporting, and remediation of the command injection flaw via firmware patches or updates for the Linksys E7350.
Enforces access authorizations to require authentication before accessing the vulnerable reset_wifi function, blocking unauthenticated remote exploitation.