CVE-2024-57228
Published: 10 January 2025
Summary
CVE-2024-57228 is a high-severity Command Injection (CWE-77) vulnerability in Linksys E7350 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of user inputs like the iface parameter on external interfaces, directly preventing command injection attacks.
Mandates timely remediation of identified flaws such as the command injection in the vif_disable function, eliminating the vulnerability through patching.
Enables vulnerability scanning to identify command injection issues like CVE-2024-57228, facilitating proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in the web interface's vif_disable function via iface parameter enables exploitation of a public-facing application (T1190) and facilitates arbitrary command execution on the network device CLI (T1059.008).
NVD Description
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
Deeper analysisAI
CVE-2024-57228 is a command injection vulnerability (CWE-77) affecting the Linksys E7350 router running firmware version 1.1.00.032. The issue resides in the vif_disable function, where the iface parameter fails to properly sanitize user input, allowing attackers to inject and execute arbitrary commands.
The vulnerability has a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating exploitation from an adjacent network with low complexity and low privileges required, and no user interaction needed. A successful attack can grant high-impact unauthorized access, potentially leading to full remote code execution, data compromise, modification of router configurations, or denial of service on the affected device.
References include a GitHub repository detailing a proof-of-concept exploit for the vulnerability in the vif_disable function, but no official vendor advisories or patches are specified in the available information.
Details
- CWE(s)