CVE-2024-57226
Published: 10 January 2025
Summary
CVE-2024-57226 is a high-severity Command Injection (CWE-77) vulnerability in Linksys E7350 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the lack of input sanitization for the iface parameter in vif_enable, preventing command injection by validating all user inputs.
Mitigates the specific command injection flaw in the Linksys E7350 vif_enable function through timely flaw remediation and patching.
Restricts the iface parameter inputs to authorized formats and values, reducing opportunities for command injection exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via the 'iface' parameter in the 'vif_enable' function of the Linksys E7350 router's web interface enables exploitation of a public-facing application (T1190) for remote command execution equivalent to network device CLI abuse (T1059.008).
NVD Description
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
Deeper analysisAI
CVE-2024-57226 is a command injection vulnerability (CWE-77) affecting the Linksys E7350 router in version 1.1.00.032. The issue resides in the vif_enable function, where the iface parameter fails to properly sanitize user input, enabling injection of arbitrary commands.
Exploitation requires an attacker to have adjacent network access (AV:A) and low privileges (PR:L), with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as scored 8.0 under CVSS 3.1, potentially allowing full system compromise through arbitrary command execution in the context of the vulnerable function.
References point to a GitHub repository at https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_2_vif_enable/README.md, which documents the vulnerability and likely includes proof-of-concept details. No official advisories or patches are detailed in the available information.
Details
- CWE(s)